861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1

General

Target

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Size

720KB
MD5

042e7c28f1bdf5bd7eb6c050a18bde92
SHA1

bde9069ebcecd98751e66655aa11401c29731dbd
SHA256

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
SHA512

b1ed1fa6ad1c0461da28450b174dbdda2f7c3981533bc1dbd06128a8a79321a744447419e69cf236812b6f2d9f2f038e2aea7acd3b08cb6d85cf51e2ddaea701
SSDEEP

12288:MXmkpZX2jjeh+8DVWJBtESRr2DTSVKjAiSGVHWeh3ih9HXA:AZmeh9WJIi1ojAiBVHBYTQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

pid	process
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

description pid process

Token: SeDebugPrivilege 1816 861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

description	pid	process
Token: SeDebugPrivilege	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
2⤵
PID:268

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
2⤵
PID:676

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
2⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
2⤵
PID:1912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-54-0x00000000003D0000-0x000000000048A000-memory.dmp

Filesize
744KB

Download
memory/1816-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1816-56-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/1816-57-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1816-58-0x00000000057F0000-0x0000000005866000-memory.dmp

Filesize
472KB

Download
memory/1816-59-0x00000000004A0000-0x00000000004DE000-memory.dmp

Filesize
248KB

Download

description	pid	process	target process
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Analysis

Sharing