5d410f76644a3f4db20b4a5eb5116f57c482d2ea09b5f8a506009702ed5da351

General

Target

9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
Size

1.1MB
MD5

9145885c6226cbd9f18c472e4ac0a4e3
SHA1

24fa80c373b83e0dffb87da409f1c312e0eaf5ff
SHA256

9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6
SHA512

c713028f419046dac9c1a85a39688f54a6f6692b475e29815617a8540340a304c1705138668880e6f0fa74c51debb278c33b0bb708a87798d4aa5a003cd66a5c
SSDEEP

24576:mPDJSb3ewHdqoXpDqDehBgLtQjC4qK3YDPIQSxFL:mPDJSb/qehyLy+4xIDPvSxFL

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 884	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	28
PID 2044 wrote to memory of 884	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	28
PID 2044 wrote to memory of 884	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	28
PID 2044 wrote to memory of 884	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	28
PID 2044 wrote to memory of 660	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	29
PID 2044 wrote to memory of 660	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	29
PID 2044 wrote to memory of 660	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	29
PID 2044 wrote to memory of 660	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	29
PID 2044 wrote to memory of 1152	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	30
PID 2044 wrote to memory of 1152	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	30
PID 2044 wrote to memory of 1152	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	30
PID 2044 wrote to memory of 1152	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	30
PID 2044 wrote to memory of 1148	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	31
PID 2044 wrote to memory of 1148	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	31
PID 2044 wrote to memory of 1148	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	31
PID 2044 wrote to memory of 1148	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	31
PID 2044 wrote to memory of 1300	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	32
PID 2044 wrote to memory of 1300	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	32
PID 2044 wrote to memory of 1300	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	32
PID 2044 wrote to memory of 1300	2044	9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe	32

C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
"C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
  2⤵
  PID:884
- C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
  2⤵
  PID:660
- C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
  2⤵
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6.exe"
  2⤵
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000370000-0x000000000049C000-memory.dmp

Filesize
1.2MB

Download
memory/2044-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/2044-57-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/2044-58-0x0000000005820000-0x00000000058E4000-memory.dmp

Filesize
784KB

Download
memory/2044-59-0x0000000005040000-0x00000000050CE000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads