a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d

Analysis

max time kernel
143s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2023 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
Size

549KB
MD5

a1ef3aeba94469b98befd1a6ba1a8b47
SHA1

72f95712aad8d71b37ce4406d5cab1431226718b
SHA256

a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d
SHA512

997ebffd7b7b4c2880afd7b3b89948eb049a59d74dd2375e1685996c0c2fe12822a17770a07a44bcf6f3224c55ea9ba94dab2b236eea1c00321988e2cb7ffe03
SSDEEP

12288:rOCbx/uQ/eP4zSGoh0vEQHqRLlJAFJBm0C:rOs8Q/m4zShh0vPILPAJ40C

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe
4752	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
Token: SeDebugPrivilege	4752	AddInProcess32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4280	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	83
PID 2548 wrote to memory of 4280	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	83
PID 2548 wrote to memory of 1760	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	84
PID 2548 wrote to memory of 1760	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	84
PID 2548 wrote to memory of 2832	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	85
PID 2548 wrote to memory of 2832	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	85
PID 2548 wrote to memory of 2064	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	86
PID 2548 wrote to memory of 2064	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	86
PID 2548 wrote to memory of 2528	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	87
PID 2548 wrote to memory of 2528	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	87
PID 2548 wrote to memory of 1116	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	88
PID 2548 wrote to memory of 1116	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	88
PID 2548 wrote to memory of 4368	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	89
PID 2548 wrote to memory of 4368	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	89
PID 2548 wrote to memory of 5048	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	90
PID 2548 wrote to memory of 5048	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	90
PID 2548 wrote to memory of 2972	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	91
PID 2548 wrote to memory of 2972	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	91
PID 2548 wrote to memory of 792	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	92
PID 2548 wrote to memory of 792	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	92
PID 2548 wrote to memory of 1384	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	93
PID 2548 wrote to memory of 1384	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	93
PID 2548 wrote to memory of 1340	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	94
PID 2548 wrote to memory of 1340	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	94
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95
PID 2548 wrote to memory of 4752	2548	a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe	95

C:\Users\Admin\AppData\Local\Temp\a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe
"C:\Users\Admin\AppData\Local\Temp\a83b3d1a4e0efa64419083e646d8cfe80942ed0804e3576c98956e7a2260848d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:2528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:1116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:4368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:5048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:1384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-133-0x0000021806C00000-0x0000021806C8E000-memory.dmp

Filesize
568KB

Download
memory/2548-134-0x0000021807050000-0x0000021807060000-memory.dmp

Filesize
64KB

Download
memory/4752-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4752-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4752-138-0x0000000001530000-0x000000000187A000-memory.dmp

Filesize
3.3MB

Download
memory/4752-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download