136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e

General

Target

136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
Size

774KB
MD5

6d594b093b4d5aef208807fcebf40e05
SHA1

dcb78d2eaa1f882f3ab142e11844bde48f1c6834
SHA256

136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e
SHA512

6fae1f69e451c374810061bb53dbe5377c4e6fa48b98769ce599aa37518a05b6350e385394ad8734bbcd12db69c6ac83e3f198e8f859cc3640327f03b5ebf5e7
SSDEEP

12288:/d6L7PVYfgiKbhaDnLMzIL2q+RTdOL8c9Ve20pNiWtvGQAPpPM89ztTVqvbTlTPe:IOyqGUL8cmNrtwP95zRVqv/lz5iQ5c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 472	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	28
PID 2308 wrote to memory of 472	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	28
PID 2308 wrote to memory of 472	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	28
PID 2308 wrote to memory of 472	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	28
PID 2308 wrote to memory of 1664	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	29
PID 2308 wrote to memory of 1664	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	29
PID 2308 wrote to memory of 1664	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	29
PID 2308 wrote to memory of 1664	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	29
PID 2308 wrote to memory of 656	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	30
PID 2308 wrote to memory of 656	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	30
PID 2308 wrote to memory of 656	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	30
PID 2308 wrote to memory of 656	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	30
PID 2308 wrote to memory of 2092	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	31
PID 2308 wrote to memory of 2092	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	31
PID 2308 wrote to memory of 2092	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	31
PID 2308 wrote to memory of 2092	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	31
PID 2308 wrote to memory of 1276	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	32
PID 2308 wrote to memory of 1276	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	32
PID 2308 wrote to memory of 1276	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	32
PID 2308 wrote to memory of 1276	2308	136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe	32

C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
"C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
  "C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
  2⤵
  PID:472
- C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
  "C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
  "C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
  2⤵
  PID:656
- C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
  "C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
  2⤵
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe
  "C:\Users\Admin\AppData\Local\Temp\136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e.exe"
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-54-0x00000000003D0000-0x0000000000496000-memory.dmp

Filesize
792KB

Download
memory/2308-55-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2308-56-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/2308-57-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2308-58-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2308-59-0x00000000051A0000-0x0000000005210000-memory.dmp

Filesize
448KB

Download
memory/2308-60-0x0000000001F70000-0x0000000001FA8000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads