0f85a9bf69c4316be205cb2ddef6366b7e36481b9849b5a6dede994474a1f134

General

Target

ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
Size

929KB
MD5

1eee890ebe5e8b5d03a2fae63f791141
SHA1

75b0c7cb4069b21b70794d25bd89a3d5bcac8205
SHA256

ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569
SHA512

c806dc7c1b857c6823369fb104173243faf350a6f34af92d749b93fd6aad0061d3aa1c24d2e3951341d4c8c17b1c79507d39d0d447940352ead727454aac79ab
SSDEEP

24576:eTsIBMNjnNNOhAe/S0uEpWBmlWDXBpYe0ZqaWcioykjEziYQp7dX:3glWDR/0UciRA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

pid	process
2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

description pid process

Token: SeDebugPrivilege 2044 ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

description	pid	process
Token: SeDebugPrivilege	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"{path}"
2⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"{path}"
2⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"{path}"
2⤵
PID:664

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"{path}"
2⤵
PID:1324

C:\Users\Admin\AppData\Local\Temp\ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
"{path}"
2⤵
PID:564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x00000000003C0000-0x00000000004AE000-memory.dmp

Filesize
952KB

Download
memory/2044-55-0x0000000004560000-0x00000000045A0000-memory.dmp

Filesize
256KB

Download
memory/2044-56-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2044-57-0x0000000004560000-0x00000000045A0000-memory.dmp

Filesize
256KB

Download
memory/2044-58-0x0000000005530000-0x00000000055E8000-memory.dmp

Filesize
736KB

Download
memory/2044-59-0x00000000055F0000-0x000000000566A000-memory.dmp

Filesize
488KB

Download

description	pid	process	target process
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1336	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 616	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 664	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 1324	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe
PID 2044 wrote to memory of 564	2044	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe	ad3a4db849a64ea07922d63153d3381798b4450f28d8db82c95393a5f6aaa569.exe

Analysis

Sharing