0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee

General

Target

1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Size

747KB
MD5

2d9d9dc24b22cccd2ca8ca4d2975115d
SHA1

1fc2da1c1c87af9637bfb4858fee4037cd5e60ab
SHA256

0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee
SHA512

45dbd9b90f8a7bf0df6b729b64d8720f49f8b28aa57a022d8b4207442bbbcf2f1a591b5223949fec8b50888fc349374d8c899b94ae8ca1c4269966590f5d3692
SSDEEP

12288:ehefaqG4yPaj5XwBtP3NjHetuoOqFyq6Fy2Mxzo3:geSqG4yPatXwBtP3N4qY6F0xM

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

pid	process
756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

description pid process

Token: SeDebugPrivilege 756 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

description	pid	process
Token: SeDebugPrivilege	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
2⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
2⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
2⤵
PID:2028

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
2⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"
2⤵
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x0000000000350000-0x0000000000412000-memory.dmp

Filesize
776KB

Download
memory/756-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/756-56-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/756-57-0x0000000000720000-0x000000000072A000-memory.dmp

Filesize
40KB

Download
memory/756-58-0x0000000005D80000-0x0000000005DDA000-memory.dmp

Filesize
360KB

Download
memory/756-59-0x0000000004940000-0x0000000004960000-memory.dmp

Filesize
128KB

Download

description	pid	process	target process
PID 756 wrote to memory of 1992	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1992	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1992	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1992	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2012	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2012	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2012	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2012	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2028	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2028	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2028	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2028	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2032	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2032	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2032	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 2032	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1488	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1488	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1488	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
PID 756 wrote to memory of 1488	756	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe	1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe

Analysis

Sharing