Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 17:24
Behavioral task
behavioral1
Sample
9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe
Resource
win10v2004-20220812-en
General
-
Target
9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe
-
Size
100KB
-
MD5
ecbfd6c4abe20cc34edbb7a584f282ee
-
SHA1
9196a6be77bd37b84e6c781f07e4fcd399b82dfd
-
SHA256
9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292
-
SHA512
660bfdd6527379f337c300850b3f9f040c25fca21400a95f79a34ba3da7b7219d767c3881eef9fa9ad631e9870857138c481638de5d87d34601579b6e1da289b
-
SSDEEP
1536:wp3ZkFRkvJU0T7Gj2gQJzD9/tNuvzunQHjUxrY33oMUlmrehn2/BG1/Bg7Q4UwW7:wpuFRkvJUxagqFZSGrY34MU2esJnp6f
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe Token: SeDebugPrivilege 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe Token: SeDebugPrivilege 5044 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe Token: SeDebugPrivilege 5044 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78 PID 4284 wrote to memory of 5044 4284 9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe"C:\Users\Admin\AppData\Local\Temp\9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exeC:\Users\Admin\AppData\Local\Temp\9103643abfcd5276bd51e03221f525264e27a2d9647cca1b2aac6547344b8292.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
-