836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238

General

Target

836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
Size

1.1MB
MD5

32fba795b35e2e048d9831c515128fdb
SHA1

e2f53d6a344d935d46bf2f108e42eab4f08239bf
SHA256

836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238
SHA512

168a76e7fa8855ca7d7aeba75abb9a92886867a5fbbf68a14246ddc9ca859311a907dae10ba232dfb071aa6a3f33023ee1e01a29261bb69c80d2f5755e5a76a4
SSDEEP

24576:hC5zbV5lwhdZhS6TTzY1MEEbGguKdnNaVaT:g5zblIdZ7TTcqFFuKdr

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
3032	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
Token: SeDebugPrivilege	3032	AddInProcess32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3872	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	85
PID 4644 wrote to memory of 3872	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	85
PID 4644 wrote to memory of 1768	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	86
PID 4644 wrote to memory of 1768	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	86
PID 4644 wrote to memory of 2232	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	87
PID 4644 wrote to memory of 2232	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	87
PID 4644 wrote to memory of 3228	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	88
PID 4644 wrote to memory of 3228	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	88
PID 4644 wrote to memory of 4512	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	89
PID 4644 wrote to memory of 4512	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	89
PID 4644 wrote to memory of 3124	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	90
PID 4644 wrote to memory of 3124	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	90
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91
PID 4644 wrote to memory of 3032	4644	836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe	91

C:\Users\Admin\AppData\Local\Temp\836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe
"C:\Users\Admin\AppData\Local\Temp\836907bfb58ca905abe606873a4a8e761d6b2573fbe61d1289d8ddb4188fc238.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:3872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:4512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:3124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-137-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/3032-139-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/3032-140-0x0000000007580000-0x00000000075E6000-memory.dmp

Filesize
408KB

Download
memory/3032-141-0x0000000002AF0000-0x0000000002B12000-memory.dmp

Filesize
136KB

Download
memory/4644-133-0x0000027EEDE60000-0x0000027EEDF78000-memory.dmp

Filesize
1.1MB

Download
memory/4644-134-0x0000027EF1320000-0x0000027EF1330000-memory.dmp

Filesize
64KB

Download
memory/4644-135-0x0000027EF1320000-0x0000027EF1330000-memory.dmp

Filesize
64KB

Download
memory/4644-136-0x0000027EF1320000-0x0000027EF1330000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing