eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68c43b3ca349cc9a76a0a0d52be2e53f.exe
Size 775KB
Sample230724-lnrl9scf6v
SHA256 eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d
MD5 68c43b3ca349cc9a76a0a0d52be2e53f
SHA1 1dd8bb9ce6d321302cb5a5f5d83ddf9fba4a7edd
SHA512 7c774ee666d1e478874f391dc7f43f15e7c0727b656266911b004a9bcd3e682f1896d0dec2c1ca2d7cb8c791a0b692a9cf0ad512b30c266d8cff90f69ed902a6
SSDEEP 12288:r5vJRBusyg5voG1vdKx5yb1+MCyoKhnl1fRIRDmTD4BUrLUJevU:FFuMusC0eFcnlxRIlmnwevU
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3852 set thread context of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe
3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe
3904	68c43b3ca349cc9a76a0a0d52be2e53f.exe
3904	68c43b3ca349cc9a76a0a0d52be2e53f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96

C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
"C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
  "C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
  2⤵
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
  "C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-139-0x0000000005D70000-0x0000000005E0C000-memory.dmp

Download

memory/3852-144-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/3852-135-0x0000000005FB0000-0x0000000006554000-memory.dmp

Download

memory/3852-136-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Download

memory/3852-137-0x0000000005CC0000-0x0000000005CD0000-memory.dmp

Download

memory/3852-138-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Download

memory/3852-141-0x0000000005CC0000-0x0000000005CD0000-memory.dmp

Download

memory/3852-140-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/3852-134-0x0000000000F60000-0x0000000001028000-memory.dmp

Download

memory/3852-133-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/3904-142-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3904-146-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3904-145-0x00000000016C0000-0x0000000001A0A000-memory.dmp

Download

memory/3904-147-0x00000000016C0000-0x0000000001A0A000-memory.dmp

Download