de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b

General

Target

de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Size

184KB
MD5

b63ba40bfabed8ee98e2b6c951987368
SHA1

a20a3caf3cfd2671fd4ee50b258caae1c27542a4
SHA256

de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b
SHA512

903164fd610583a34e119de0f4c0703f311406874be47479cbfcfa7695fbcb2ae25fa16c62cfa879dfa5ea96736d90ec7fb1aa58ed7c932b0312515ba2fe82eb
SSDEEP

3072:/U/KGW8seST3aQgHw0I+Kaj7Fep0FmRFv7VL/wUNx1MZp2cyP/wZYfmELb8mZW2v:/ywoQ0jRCF7DiGTwYO35E8at

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Token: SeDebugPrivilege	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1284	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	14
PID 2028 wrote to memory of 260	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	4
PID 2028 wrote to memory of 332	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	3
PID 2028 wrote to memory of 368	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	2
PID 2028 wrote to memory of 384	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	1
PID 2028 wrote to memory of 420	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	5
PID 2028 wrote to memory of 464	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	6
PID 2028 wrote to memory of 480	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	7
PID 2028 wrote to memory of 488	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	8
PID 2028 wrote to memory of 600	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	24
PID 2028 wrote to memory of 676	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	23
PID 2028 wrote to memory of 764	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	22
PID 2028 wrote to memory of 816	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	9
PID 2028 wrote to memory of 856	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	21
PID 2028 wrote to memory of 880	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	10
PID 2028 wrote to memory of 284	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	20
PID 2028 wrote to memory of 1028	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	19
PID 2028 wrote to memory of 1056	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	11
PID 2028 wrote to memory of 1140	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	18
PID 2028 wrote to memory of 1248	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	12
PID 2028 wrote to memory of 1800	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	17
PID 2028 wrote to memory of 756	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	16
PID 2028 wrote to memory of 1772	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	15
PID 2028 wrote to memory of 2004	2028	de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe	25

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1248
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:880
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1772
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1056
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:756
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1800
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1140
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1028
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:856
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:2004
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
  "C:\Users\Admin\AppData\Local\Temp\de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-59-0x0000000002990000-0x000000000299D000-memory.dmp

Filesize
52KB

Download
memory/2028-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2028-55-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/2028-56-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/2028-57-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/2028-58-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads