85025d82417b78241eb3e406ed633597911e1b73ae5f712f03ee18f60b16324b

General

Target

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
Size

1.5MB
MD5

13dc441ec2f9e3f9aa1f354a4b14d318
SHA1

05b62c596ca78745d73514cd5d43434929955863
SHA256

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
SHA512

30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
SSDEEP

24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 572	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	27
PID 956 wrote to memory of 572	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	27
PID 956 wrote to memory of 572	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	27
PID 956 wrote to memory of 572	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	27
PID 956 wrote to memory of 1696	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	28
PID 956 wrote to memory of 1696	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	28
PID 956 wrote to memory of 1696	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	28
PID 956 wrote to memory of 1696	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	28
PID 956 wrote to memory of 1732	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	29
PID 956 wrote to memory of 1732	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	29
PID 956 wrote to memory of 1732	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	29
PID 956 wrote to memory of 1732	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	29
PID 956 wrote to memory of 1768	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	30
PID 956 wrote to memory of 1768	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	30
PID 956 wrote to memory of 1768	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	30
PID 956 wrote to memory of 1768	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	30
PID 956 wrote to memory of 108	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	31
PID 956 wrote to memory of 108	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	31
PID 956 wrote to memory of 108	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	31
PID 956 wrote to memory of 108	956	6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe	31

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
  "C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
  "C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
  "C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
  "C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
  "C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"
  2⤵
  PID:108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000000080000-0x0000000000208000-memory.dmp

Filesize
1.5MB

Download
memory/956-55-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/956-56-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/956-57-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/956-58-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/956-59-0x0000000005B70000-0x0000000005CA8000-memory.dmp

Filesize
1.2MB

Download
memory/956-60-0x000000000A260000-0x000000000A410000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads