c233b5359370a026201a1648489a3f1f91fd11cadb41e87ce45c60ea3a15f8f1

Analysis

max time kernel
48s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
Size

716KB
MD5

dba3734fb68e3c000cdf40fad3069efe
SHA1

2d7d2df1435f9799a58e5cf96a45dbfc28c6f985
SHA256

c233b5359370a026201a1648489a3f1f91fd11cadb41e87ce45c60ea3a15f8f1
SHA512

12ebf689f55017b39eca1e929f7fd32a8a83b9b3114df8f21c9aab105a058ccca1884f69be964b2c05ff93037152fae35611f6f81f3cf1788d07e9de803ba4c8
SSDEEP

12288:BbSJgvm8ik/5EBlf7vCxpYUUp3Ff+YMF2t/a7HRg:BbSJgvm8ikyBFvCxpOj82Ra

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 868	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	28
PID 2040 wrote to memory of 868	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	28
PID 2040 wrote to memory of 868	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	28
PID 2040 wrote to memory of 868	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	28
PID 2040 wrote to memory of 664	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	29
PID 2040 wrote to memory of 664	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	29
PID 2040 wrote to memory of 664	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	29
PID 2040 wrote to memory of 664	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	29
PID 2040 wrote to memory of 684	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	30
PID 2040 wrote to memory of 684	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	30
PID 2040 wrote to memory of 684	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	30
PID 2040 wrote to memory of 684	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	30
PID 2040 wrote to memory of 268	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	31
PID 2040 wrote to memory of 268	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	31
PID 2040 wrote to memory of 268	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	31
PID 2040 wrote to memory of 268	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	31
PID 2040 wrote to memory of 564	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	32
PID 2040 wrote to memory of 564	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	32
PID 2040 wrote to memory of 564	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	32
PID 2040 wrote to memory of 564	2040	RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe	32

C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
"C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
  "C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
  2⤵
  PID:868
- C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
  "C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
  "C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
  2⤵
  PID:684
- C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
  "C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe
  "C:\Users\Admin\AppData\Local\Temp\RE,RE,RE,RE,RE,RE,RE Best offer and ETD.exe"
  2⤵
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000003B0000-0x0000000000468000-memory.dmp

Filesize
736KB

Download
memory/2040-55-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2040-56-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/2040-57-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2040-58-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2040-59-0x0000000005910000-0x0000000005980000-memory.dmp

Filesize
448KB

Download
memory/2040-60-0x0000000000870000-0x00000000008A8000-memory.dmp

Filesize
224KB

Download