044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4

General

Target

044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
Size

704KB
MD5

b84f2f3a8f2c340d2d0d931454eea49b
SHA1

5640f48cb80b6bc39b54d039e3dc87db7bfa05cf
SHA256

044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4
SHA512

c8be86dfe99ba6f9cf544f2c105b18be7086960a14697448bcaa9ac85fe40d23bdd5068f7cadc21f9debeadd05c2dc41ef10d0edfe2f9bbca24da8ee56a89816
SSDEEP

12288:RO6CEN1VXN1+kGAsnwgGHJINvoB6WtB6I04qvuFbbGDfe:x1+kpxpI2/r6eqmJbGDW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

pid	process
1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

description pid process

Token: SeDebugPrivilege 1424 044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

description	pid	process
Token: SeDebugPrivilege	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
2⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
2⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
2⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
2⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
"C:\Users\Admin\AppData\Local\Temp\044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe"
2⤵
PID:1688

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-54-0x00000000003B0000-0x0000000000466000-memory.dmp

Filesize
728KB

Download
memory/1424-55-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/1424-56-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/1424-57-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/1424-58-0x00000000007B0000-0x00000000007BC000-memory.dmp

Filesize
48KB

Download
memory/1424-59-0x0000000005F20000-0x0000000005F90000-memory.dmp

Filesize
448KB

Download
memory/1424-60-0x0000000001FE0000-0x0000000002018000-memory.dmp

Filesize
224KB

Download

description	pid	process	target process
PID 1424 wrote to memory of 2040	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 2040	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 2040	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 2040	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1864	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1864	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1864	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1864	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1752	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1752	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1752	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1752	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1708	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1708	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1708	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1708	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1688	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1688	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1688	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe
PID 1424 wrote to memory of 1688	1424	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe	044c6038df71898680d1927a2a3251d58925ab0b91a5cc17ffc6599fe155f9c4.exe

Analysis

Sharing