806c6ea4cb92ecf2b21e2501505537c22fd74f7f7c3d2fdf6db7023c1bb2acba

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 13:07

Target

International Remittance 023ORMTT0045123.exe
Size

706KB
MD5

ee9015dba8e57de7c85dfa0f123e355e
SHA1

17d0e1882520aedcb3c8364828774483116d27cf
SHA256

6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
SHA512

59ebaea0b4f623b534ea05a2c92b6ae2894b0f81347eae84ba9732daefa9783f78d59a0bc4c1bb16bd88c414d539c4c7b68895d81412d6dae0b519cef91b9617
SSDEEP

12288:UTyx0YPX/NqPs+mYQ261glD6CMaIRv7e9Kcwejet/kZ3IVSIcTB:UTBHPsLYn6nuOe9Qkb0SIQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2648 set thread context of 4504	2648	International Remittance 023ORMTT0045123.exe	85

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2648	International Remittance 023ORMTT0045123.exe
2648	International Remittance 023ORMTT0045123.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe
4504	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	International Remittance 023ORMTT0045123.exe
Token: SeDebugPrivilege	4504	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 5072	2648	International Remittance 023ORMTT0045123.exe	84
PID 2648 wrote to memory of 5072	2648	International Remittance 023ORMTT0045123.exe	84
PID 2648 wrote to memory of 5072	2648	International Remittance 023ORMTT0045123.exe	84
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85
PID 2648 wrote to memory of 4504	2648	International Remittance 023ORMTT0045123.exe	85

C:\Users\Admin\AppData\Local\Temp\International Remittance 023ORMTT0045123.exe
"C:\Users\Admin\AppData\Local\Temp\International Remittance 023ORMTT0045123.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504

memory/2648-133-0x00000000004C0000-0x0000000000576000-memory.dmp

Filesize
728KB

Download
memory/2648-134-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/2648-135-0x0000000004F50000-0x0000000004FE2000-memory.dmp

Filesize
584KB

Download
memory/2648-136-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Filesize
40KB

Download
memory/2648-137-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download
memory/2648-138-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download
memory/2648-139-0x0000000006050000-0x00000000060EC000-memory.dmp

Filesize
624KB

Download
memory/4504-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4504-142-0x0000000001860000-0x0000000001BAA000-memory.dmp

Filesize
3.3MB

Download
memory/4504-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download