add8dea19a5377579ef947edfea661faea738c2b565ea031a1a85607b1e6bea1

General

Target

a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
Size

1.0MB
MD5

0b94975f5dde6feab979853991933616
SHA1

6b15f943d7ae7e265e455026a70b2116bc7a407d
SHA256

a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6
SHA512

7e8a156ea625dbe2d15f76a70bd79b6a123526ee1d71450b8e16b3df069f9cf6c2d25e9ee7796d644891537ee243618ae39ede7f4e1c75a66618c9ab1e452a37
SSDEEP

24576:cWRK9jeP8CWr4cBKXh83adVzgXF37tBJp:cWQ9+8Br45Xe36VS37H

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 864	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	28
PID 1764 wrote to memory of 864	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	28
PID 1764 wrote to memory of 864	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	28
PID 1764 wrote to memory of 864	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	28
PID 1764 wrote to memory of 668	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	29
PID 1764 wrote to memory of 668	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	29
PID 1764 wrote to memory of 668	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	29
PID 1764 wrote to memory of 668	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	29
PID 1764 wrote to memory of 1344	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	30
PID 1764 wrote to memory of 1344	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	30
PID 1764 wrote to memory of 1344	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	30
PID 1764 wrote to memory of 1344	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	30
PID 1764 wrote to memory of 1920	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	31
PID 1764 wrote to memory of 1920	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	31
PID 1764 wrote to memory of 1920	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	31
PID 1764 wrote to memory of 1920	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	31
PID 1764 wrote to memory of 520	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	32
PID 1764 wrote to memory of 520	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	32
PID 1764 wrote to memory of 520	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	32
PID 1764 wrote to memory of 520	1764	a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe	32

C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
  "C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
  2⤵
  PID:864
- C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
  "C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
  2⤵
  PID:668
- C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
  "C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
  2⤵
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
  "C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
  2⤵
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe
  "C:\Users\Admin\AppData\Local\Temp\a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6.exe"
  2⤵
  PID:520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-54-0x0000000000310000-0x000000000041C000-memory.dmp

Filesize
1.0MB

Download
memory/1764-55-0x00000000050E0000-0x0000000005120000-memory.dmp

Filesize
256KB

Download
memory/1764-56-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download
memory/1764-57-0x00000000050E0000-0x0000000005120000-memory.dmp

Filesize
256KB

Download
memory/1764-58-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1764-59-0x0000000005220000-0x00000000052D4000-memory.dmp

Filesize
720KB

Download
memory/1764-60-0x0000000005050000-0x00000000050D0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads