be1bc698d63cbfc97d75edaa1fe850772d1e082a7b9a24aa5e09ed5b3bdeedde

Resubmissions

25-12-2022 14:22

221225-rppf7abf39 10

25-12-2022 14:22

25-12-2022 14:21

25-12-2022 14:21

25-12-2022 14:13

Analysis

max time kernel
54s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-12-2022 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Size

850KB
MD5

f183d934a954fc80602a9173f55f22c9
SHA1

a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA256

95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA512

48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
SSDEEP

12288:jYmzPxoepv5EUOPri4BTVUDnV89SxP3ol8VU9o:/xoS6TjUDnlP3G9o

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 4240	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	68
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1000	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	69
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 1936	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	70
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 3440	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	71
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72
PID 3824 wrote to memory of 1788	3824	95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe	72

C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
"C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
  "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
  "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
  "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
  "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
  2⤵
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
  "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
  2⤵
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3824-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-150-0x00000000003A0000-0x000000000047A000-memory.dmp

Filesize
872KB

Download
memory/3824-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-153-0x0000000005010000-0x00000000050AC000-memory.dmp

Filesize
624KB

Download
memory/3824-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3824-196-0x0000000005AE0000-0x0000000005B10000-memory.dmp

Filesize
192KB

Download
memory/3824-197-0x0000000006020000-0x000000000651E000-memory.dmp

Filesize
5.0MB

Download
memory/3824-198-0x0000000005C20000-0x0000000005CB2000-memory.dmp

Filesize
584KB

Download
memory/3824-201-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

Filesize
40KB

Download
memory/3824-205-0x0000000008180000-0x0000000008198000-memory.dmp

Filesize
96KB

Download
memory/3824-208-0x0000000008510000-0x000000000852A000-memory.dmp

Filesize
104KB

Download
memory/3824-209-0x000000000AC20000-0x000000000AC26000-memory.dmp

Filesize
24KB

Download