c384c293bcac89ee673842d9ee4f51ef4006f50ac3e1bd3011dd584a2f302bf8

Analysis

max time kernel
152s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kopija uplate.exe
Size

1.2MB
MD5

1349c7c55f1542bf80759c0413d5efbc
SHA1

d1c3a26f32958f141816f6838cf1c0c27ca7a689
SHA256

c384c293bcac89ee673842d9ee4f51ef4006f50ac3e1bd3011dd584a2f302bf8
SHA512

d332bf8ffa0ab72084259348286a145e87848335531a210047dd9fb349fbf9fe908234cd5beefca7db867659b6223b7bd293bef830a64fa7d4f83d86c724bb7a
SSDEEP

24576:dlqHTiwAAgEEY40JqZbREvD5gXc5MHXbnWgxuFgY:ATQp0Jsb+vDKs+3bfG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

Kopija uplate.exepowershell.exe

pid	process
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
5072	Kopija uplate.exe
3452	powershell.exe
3452	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Kopija uplate.exepowershell.exe

description pid process

Token: SeDebugPrivilege 5072 Kopija uplate.exe
Token: SeDebugPrivilege 3452 powershell.exe

description	pid	process
Token: SeDebugPrivilege	5072	Kopija uplate.exe
Token: SeDebugPrivilege	3452	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Kopija uplate.execmd.exe

description	pid	process	target process
PID 5072 wrote to memory of 3056	5072	Kopija uplate.exe	cmd.exe
PID 5072 wrote to memory of 3056	5072	Kopija uplate.exe	cmd.exe
PID 5072 wrote to memory of 3056	5072	Kopija uplate.exe	cmd.exe
PID 3056 wrote to memory of 3452	3056	cmd.exe	powershell.exe
PID 3056 wrote to memory of 3452	3056	cmd.exe	powershell.exe
PID 3056 wrote to memory of 3452	3056	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Kopija uplate.exe
"C:\Users\Admin\AppData\Local\Temp\Kopija uplate.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Kopija uplate.exe' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Kopija uplate.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-138-0x0000000000000000-mapping.dmp

Download
memory/3452-144-0x0000000006590000-0x00000000065AE000-memory.dmp

Filesize
120KB

Download
memory/3452-139-0x0000000000000000-mapping.dmp

Download
memory/3452-148-0x0000000006B80000-0x0000000006BA2000-memory.dmp

Filesize
136KB

Download
memory/3452-147-0x0000000007620000-0x00000000076B6000-memory.dmp

Filesize
600KB

Download
memory/3452-141-0x00000000057E0000-0x0000000005E08000-memory.dmp

Filesize
6.2MB

Download
memory/3452-146-0x0000000006A80000-0x0000000006A9A000-memory.dmp

Filesize
104KB

Download
memory/3452-145-0x0000000007C00000-0x000000000827A000-memory.dmp

Filesize
6.5MB

Download
memory/3452-140-0x0000000004FE0000-0x0000000005016000-memory.dmp

Filesize
216KB

Download
memory/3452-143-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/3452-142-0x00000000055F0000-0x0000000005612000-memory.dmp

Filesize
136KB

Download
memory/5072-137-0x0000000008D30000-0x0000000008D96000-memory.dmp

Filesize
408KB

Download
memory/5072-132-0x0000000000020000-0x0000000000162000-memory.dmp

Filesize
1.3MB

Download
memory/5072-134-0x0000000004B00000-0x0000000004B92000-memory.dmp

Filesize
584KB

Download
memory/5072-133-0x0000000004FB0000-0x0000000005554000-memory.dmp

Filesize
5.6MB

Download
memory/5072-136-0x00000000087D0000-0x000000000886C000-memory.dmp

Filesize
624KB

Download
memory/5072-135-0x0000000004CC0000-0x0000000004CCA000-memory.dmp

Filesize
40KB

Download