f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

General

Target

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Size

422KB
MD5

f3c7542ddd9b9479f5904e1b6ba67f95
SHA1

fd45581c675f6646adb9427ad296c91062e55423
SHA256

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3
SHA512

1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13
SSDEEP

6144:T062e/kYFnSwsCyuMj5Gm92/6SOVG9ggtKBUI18HmiI1g6MFyMBpjOhAmTQDHGNM:JjFdsPVGSW7tK91KmNglBpqhvTQTGN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

pid process

1500 f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Loads dropped DLL 3 IoCs

Processes:

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exedw20.exe

pid process

936 f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
892 dw20.exe
892 dw20.exe

pid	process
1500	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

pid	process
936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
892	dw20.exe
892	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

description	pid	process	target process
PID 936 set thread context of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

description pid process

Token: SeDebugPrivilege 936 f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

description	pid	process
Token: SeDebugPrivilege	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exef3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

description	pid	process	target process
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 936 wrote to memory of 1500	936	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
PID 1500 wrote to memory of 892	1500	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	dw20.exe
PID 1500 wrote to memory of 892	1500	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	dw20.exe
PID 1500 wrote to memory of 892	1500	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	dw20.exe
PID 1500 wrote to memory of 892	1500	f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
"C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
"C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 764
3⤵
- Loads dropped DLL
PID:892

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Filesize
422KB

MD5
f3c7542ddd9b9479f5904e1b6ba67f95

SHA1
fd45581c675f6646adb9427ad296c91062e55423

SHA256
f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

SHA512
1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

Download Submit
\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Filesize
422KB

MD5
f3c7542ddd9b9479f5904e1b6ba67f95

SHA1
fd45581c675f6646adb9427ad296c91062e55423

SHA256
f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

SHA512
1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

Download Submit
\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Filesize
422KB

MD5
f3c7542ddd9b9479f5904e1b6ba67f95

SHA1
fd45581c675f6646adb9427ad296c91062e55423

SHA256
f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

SHA512
1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

Download Submit
\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
Filesize
422KB

MD5
f3c7542ddd9b9479f5904e1b6ba67f95

SHA1
fd45581c675f6646adb9427ad296c91062e55423

SHA256
f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

SHA512
1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

Download Submit
memory/892-73-0x0000000000000000-mapping.dmp

Download
memory/936-67-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/936-55-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/936-56-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/936-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1500-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-68-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-72-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-64-0x0000000000448FCE-mapping.dmp

Download
memory/1500-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-58-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1500-77-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing