61bca95b6a024da3cc6ac31c4e24d470d9750a6838cf285136ba7a70f9be847e

General

Target

b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
Size

827KB
MD5

a1ce7b26712e1db177d86fa87d09c354
SHA1

23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256

b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512

e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4
SSDEEP

12288:IKY7z5GoJiGaq5auxKSjipNvJDK2WSqcIVr4vo1euUTyH2BQMyEp0mpefJ3Lww:G5GoR5amjipNvFK2LXG3VrEuqqJ8w

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1096	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	28
PID 1284 wrote to memory of 1096	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	28
PID 1284 wrote to memory of 1096	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	28
PID 1284 wrote to memory of 1096	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	28
PID 1284 wrote to memory of 432	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	29
PID 1284 wrote to memory of 432	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	29
PID 1284 wrote to memory of 432	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	29
PID 1284 wrote to memory of 432	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	29
PID 1284 wrote to memory of 544	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	30
PID 1284 wrote to memory of 544	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	30
PID 1284 wrote to memory of 544	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	30
PID 1284 wrote to memory of 544	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	30
PID 1284 wrote to memory of 268	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	31
PID 1284 wrote to memory of 268	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	31
PID 1284 wrote to memory of 268	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	31
PID 1284 wrote to memory of 268	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	31
PID 1284 wrote to memory of 868	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	32
PID 1284 wrote to memory of 868	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	32
PID 1284 wrote to memory of 868	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	32
PID 1284 wrote to memory of 868	1284	b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe	32

C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
"C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
  "C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
  "C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
  "C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
  2⤵
  PID:544
- C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
  "C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe
  "C:\Users\Admin\AppData\Local\Temp\b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e.exe"
  2⤵
  PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-54-0x0000000000350000-0x0000000000426000-memory.dmp

Filesize
856KB

Download
memory/1284-55-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download
memory/1284-56-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/1284-57-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download
memory/1284-58-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/1284-59-0x0000000007F60000-0x0000000007FF0000-memory.dmp

Filesize
576KB

Download
memory/1284-60-0x00000000044B0000-0x000000000450C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads