dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4218b9cf266916690af26776acf29627.exe
Size

576KB
MD5

4218b9cf266916690af26776acf29627
SHA1

d69e2af929a0d406d7eea8316e9747db1d4a7ff0
SHA256

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b
SHA512

fad04a07efa85b91c64022f0b9b1fefdc80a59cd9127e6c1d750f803e2377c71793f20add0532ab2ed595cc9a98a8c9d522c6c42bc6fc07cfdfd2eddf9954d05
SSDEEP

12288:xWO+lpbKbfO7FoxgcSkgyZyfOL5eJxnS4ta5NG3WlViKY:xWnbKzxgcSkgyZeO0TtWN+

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

4218b9cf266916690af26776acf29627.exe

pid	process
1980	4218b9cf266916690af26776acf29627.exe
1980	4218b9cf266916690af26776acf29627.exe
1980	4218b9cf266916690af26776acf29627.exe
1980	4218b9cf266916690af26776acf29627.exe
1980	4218b9cf266916690af26776acf29627.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4218b9cf266916690af26776acf29627.exe

description pid process

Token: SeDebugPrivilege 1980 4218b9cf266916690af26776acf29627.exe

description	pid	process
Token: SeDebugPrivilege	1980	4218b9cf266916690af26776acf29627.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4218b9cf266916690af26776acf29627.exe

C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
"C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
  "C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
  "C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
  2⤵
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
  "C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
  2⤵
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
  "C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe
  "C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"
  2⤵
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x00000000003C0000-0x0000000000456000-memory.dmp

Filesize
600KB

Download
memory/1980-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/1980-57-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/1980-58-0x00000000050C0000-0x0000000005130000-memory.dmp

Filesize
448KB

Download
memory/1980-59-0x0000000001F40000-0x0000000001F74000-memory.dmp

Filesize
208KB

Download

description	pid	process	target process
PID 1980 wrote to memory of 1688	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1688	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1688	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1688	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1208	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1208	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1208	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1208	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1468	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1468	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1468	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1468	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1488	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1488	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1488	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1488	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1300	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1300	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1300	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe
PID 1980 wrote to memory of 1300	1980	4218b9cf266916690af26776acf29627.exe	4218b9cf266916690af26776acf29627.exe