ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Size

210KB
MD5

a9e77045cee25859b1de4aebcfae17e2
SHA1

c072142187f071cae6657b4c346c2bffded45284
SHA256

ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da
SHA512

e18f0d017cb18e7161dcf8abe0e361bf19fbc8618261c95e19b01baf3b0274d6c07d1b0267d86adb619ebfbeb35c2ae544d966ca603bbe252fea4eb909e276d9
SSDEEP

3072:JBnTtlU8BJjLk/JgRIn9AsUfbCwW8sest6oY8nwVLmVDG4YJqC7eTpsv:JT2WJ+JgO9/UfuxvFYVVMDXqqCiGv

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: 10664725708588318870	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 4278190080	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 1207959552	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 3472883712	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 1	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 10664725708588318870	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 4278190080	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 1207959552	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 3472883712	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 1	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 0	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 1013612281865	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 876173340956	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 12283606466828	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 85899346028	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 0	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 15564961480708	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 747324309700	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 4294967297	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 12884901889	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 51539607780	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Token: 51539607716	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 3064	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe	67
PID 3376 wrote to memory of 3064	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe	67
PID 3376 wrote to memory of 3064	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe	67
PID 3376 wrote to memory of 3064	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe	67
PID 3376 wrote to memory of 3064	3376	ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe	67

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
  "C:\Users\Admin\AppData\Local\Temp\ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3376-132-0x0000000000A00000-0x0000000000A23000-memory.dmp

Filesize
140KB

Download
memory/3376-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download