9e39b32f6d7a4003b5a643f9fbf6b7accb8b17540375268641cd9843dc9f674e

General

Target

44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
Size

859KB
MD5

a1beddb06d1826829f7ff5f86e3fd9c0
SHA1

9f2562a5e1f702b11183df715e71ff77e0284d41
SHA256

44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b
SHA512

3bafe9bde27096fe04ea1b8a4e4e543c51f20902505988d4c68476c192109362ccc86b59bac82c179fcb8d6f4c2f3d561706a5441378997d1968d5ab286c22cb
SSDEEP

12288:899/9WflU/9XxworMzl5mWhm+DvuL4lZQbcRiv1Gnt2vJa+4pgexi:8/ylUFMmW/Dv5DQ714YaFpxi

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

pid	process
1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

description pid process

Token: SeDebugPrivilege 1532 44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

description	pid	process
Token: SeDebugPrivilege	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
2⤵
PID:772

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
2⤵
PID:908

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
2⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
2⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
"C:\Users\Admin\AppData\Local\Temp\44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe"
2⤵
PID:600

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x0000000000360000-0x000000000043E000-memory.dmp

Filesize
888KB

Download
memory/1532-55-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/1532-56-0x00000000006A0000-0x00000000006B2000-memory.dmp

Filesize
72KB

Download
memory/1532-57-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/1532-58-0x0000000000870000-0x000000000087C000-memory.dmp

Filesize
48KB

Download
memory/1532-59-0x0000000005330000-0x00000000053A0000-memory.dmp

Filesize
448KB

Download
memory/1532-60-0x00000000020D0000-0x0000000002108000-memory.dmp

Filesize
224KB

Download

description	pid	process	target process
PID 1532 wrote to memory of 772	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 772	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 772	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 772	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 908	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 908	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 908	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 908	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1500	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1500	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1500	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1500	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1652	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1652	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1652	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 1652	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 600	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 600	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 600	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe
PID 1532 wrote to memory of 600	1532	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe	44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b.exe

Analysis

Sharing