09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1

General

Target

09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe
Size

819KB
MD5

58a918daf1703e245352c95a295e1911
SHA1

b28adb51bf00797935f472bb2ccf6b1de5b76e3f
SHA256

09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1
SHA512

70f0355ad66f01992972843fd37b1655ddc60daa05dae990241a0c284d83537f24433ad91c5ad443b255f18da97135e9654c4d8f043b3e8f2b9f681a7a6ead84
SSDEEP

24576:BzAeApF12xPo56vWmqDK1rrrrr5vrrrrLMBm:BzQpF1WWmqZm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe
5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4952	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	80
PID 5064 wrote to memory of 4952	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	80
PID 5064 wrote to memory of 4952	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	80
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81
PID 5064 wrote to memory of 4964	5064	09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe	81

C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe
"C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe
  "C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe
  "C:\Users\Admin\AppData\Local\Temp\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe"
  2⤵
  PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\09b8fc4516406c47cc51528cb37c66faa58b46ce8fc1a652c9f88baf38e5a5b1.exe.log

Filesize
411B

MD5
39582d3351c79bbe6b34c92b86bb2e15

SHA1
0a5bc37313778570ffd8b7664fd04380446641f3

SHA256
a77ea8a3f342c18bc35e84d0c0255345ae259f80dd9ac4837760e5e4d5f593aa

SHA512
4e6acca2e4fd55d3dcdcaba0155364dcf17924113f23bb58c895e0119a79906f4e3fd1950d1dbb405cc02509373a1e2057a46dbc364189779ae96abb19214283

Download Submit
memory/4964-149-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-168-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-138-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-173-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4964-152-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-140-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-141-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-143-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-142-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-144-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-146-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-147-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-135-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-139-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-156-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-159-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-158-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-155-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4964-161-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-162-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-165-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-164-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-151-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-169-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4964-171-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/5064-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/5064-137-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing