164790d71da9d108d7baa215cf5336f0fd568d542cd18752688f9f7769dc28b7

General

Target

bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
Size

1.5MB
MD5

39810b7912907fc879004874df0e9e9e
SHA1

f2e51d5e9f644058a8ff4d64458e2914ddf2a364
SHA256

bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61
SHA512

abd49e8623428a399f665e2157522b6d285cb6c1f77c043eb22038df2ebbfbb21f3823c08dd781be5df043f1ab9b514990ab890bc80086cf33860aa6f4e75b5d
SSDEEP

24576:molqfbt8n/WmtqmZfq/ppZge1+qWMZukXfRtgyCrWw:sxgWm8m+Zj+qbZuq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 588	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	27
PID 2000 wrote to memory of 588	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	27
PID 2000 wrote to memory of 588	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	27
PID 2000 wrote to memory of 588	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	27
PID 2000 wrote to memory of 1324	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	28
PID 2000 wrote to memory of 1324	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	28
PID 2000 wrote to memory of 1324	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	28
PID 2000 wrote to memory of 1324	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	28
PID 2000 wrote to memory of 1484	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	29
PID 2000 wrote to memory of 1484	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	29
PID 2000 wrote to memory of 1484	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	29
PID 2000 wrote to memory of 1484	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	29
PID 2000 wrote to memory of 520	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	30
PID 2000 wrote to memory of 520	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	30
PID 2000 wrote to memory of 520	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	30
PID 2000 wrote to memory of 520	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	30
PID 2000 wrote to memory of 596	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	31
PID 2000 wrote to memory of 596	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	31
PID 2000 wrote to memory of 596	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	31
PID 2000 wrote to memory of 596	2000	bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe	31

C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
"C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
  "C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
  2⤵
  PID:588
- C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
  "C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
  "C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
  "C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
  2⤵
  PID:520
- C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe
  "C:\Users\Admin\AppData\Local\Temp\bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61.exe"
  2⤵
  PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000000370000-0x00000000004EC000-memory.dmp

Filesize
1.5MB

Download
memory/2000-55-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2000-56-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/2000-57-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2000-58-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/2000-59-0x0000000005CC0000-0x0000000005DF8000-memory.dmp

Filesize
1.2MB

Download
memory/2000-60-0x0000000007E70000-0x0000000008020000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads