6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

Analysis

max time kernel
48s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8545b3c5f346723524e6dd29bfe64083.exe
Size

948KB
MD5

8545b3c5f346723524e6dd29bfe64083
SHA1

e864f9c2d68edb928217325e5c8e8cc5eb86dc3f
SHA256

6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac
SHA512

42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696
SSDEEP

24576:Iky9IISJqTZPEeqJa5E7Om5Fi5EuyuqUc+3l9:Y2eoam5FS9q

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

8545b3c5f346723524e6dd29bfe64083.exe

pid	process
1644	8545b3c5f346723524e6dd29bfe64083.exe
1644	8545b3c5f346723524e6dd29bfe64083.exe
1644	8545b3c5f346723524e6dd29bfe64083.exe
1644	8545b3c5f346723524e6dd29bfe64083.exe
1644	8545b3c5f346723524e6dd29bfe64083.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8545b3c5f346723524e6dd29bfe64083.exe

description pid process

Token: SeDebugPrivilege 1644 8545b3c5f346723524e6dd29bfe64083.exe

description	pid	process
Token: SeDebugPrivilege	1644	8545b3c5f346723524e6dd29bfe64083.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

8545b3c5f346723524e6dd29bfe64083.exe

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
2⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
2⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
2⤵
PID:1496

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
2⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
"C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
2⤵
PID:588

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x00000000003F0000-0x00000000004E4000-memory.dmp

Filesize
976KB

Download
memory/1644-55-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1644-56-0x0000000000670000-0x0000000000684000-memory.dmp

Filesize
80KB

Download
memory/1644-57-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1644-58-0x0000000000690000-0x000000000069C000-memory.dmp

Filesize
48KB

Download
memory/1644-59-0x0000000005800000-0x00000000058D2000-memory.dmp

Filesize
840KB

Download
memory/1644-60-0x0000000002130000-0x000000000217C000-memory.dmp

Filesize
304KB

Download

description	pid	process	target process
PID 1644 wrote to memory of 568	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 568	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 568	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 568	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1312	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1312	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1312	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1312	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1496	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1496	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1496	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1496	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1064	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1064	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1064	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 1064	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 588	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 588	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 588	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe
PID 1644 wrote to memory of 588	1644	8545b3c5f346723524e6dd29bfe64083.exe	8545b3c5f346723524e6dd29bfe64083.exe