b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6

General

Target

b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
Size

432KB
MD5

f874fde4b1751554375043eccf69b156
SHA1

efa3bde56f6fe8627f4989b3ccfade1df914d4ca
SHA256

b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6
SHA512

6fc50b738216522a831784bf0af47a5776d85a396a095306436fe58c22af07f66d08bf520507d8fa82effbcc02fb5fc1f08f4284f639c18dedd387be509a7678
SSDEEP

6144:pP1pgHF5zHGX/yIPEReBIG/4aIP+1BUnqY0OfuGZMBzl32yH3S:pPEnjRIMkz4aIP+1BaqY70V2yX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1076	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1076	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29
PID 1980 wrote to memory of 1076	1980	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	29

C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
"C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
  "C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-75-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-57-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-76-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-59-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-64-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-63-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-65-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-61-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-56-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-70-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-68-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-95-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/1076-74-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-96-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/1076-94-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-77-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-78-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-79-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-80-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-82-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-83-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-85-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-87-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-88-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-91-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-92-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1980-55-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-73-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing