861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1

General

Target

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Size

720KB
MD5

042e7c28f1bdf5bd7eb6c050a18bde92
SHA1

bde9069ebcecd98751e66655aa11401c29731dbd
SHA256

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
SHA512

b1ed1fa6ad1c0461da28450b174dbdda2f7c3981533bc1dbd06128a8a79321a744447419e69cf236812b6f2d9f2f038e2aea7acd3b08cb6d85cf51e2ddaea701
SSDEEP

12288:MXmkpZX2jjeh+8DVWJBtESRr2DTSVKjAiSGVHWeh3ih9HXA:AZmeh9WJIi1ojAiBVHBYTQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	28
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	28
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	28
PID 1816 wrote to memory of 268	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	28
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	29
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	29
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	29
PID 1816 wrote to memory of 676	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	29
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	30
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	30
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	30
PID 1816 wrote to memory of 1108	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	30
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	31
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	31
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	31
PID 1816 wrote to memory of 1288	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	31
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	32
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	32
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	32
PID 1816 wrote to memory of 1912	1816	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	32

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-54-0x00000000003D0000-0x000000000048A000-memory.dmp

Filesize
744KB

Download
memory/1816-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1816-56-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/1816-57-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1816-58-0x00000000057F0000-0x0000000005866000-memory.dmp

Filesize
472KB

Download
memory/1816-59-0x00000000004A0000-0x00000000004DE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads