c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce

Resubmissions

05-08-2023 04:19

230805-exxfjsff83 3

05-08-2023 04:09

230805-eq4laaff69 10

Analysis

max time kernel
359s
max time network
363s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05-08-2023 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
Size

2.2MB
MD5

855358b2e478b0bc1d7ffeef2bbf6597
SHA1

f51cd947c16dd0eb64d53790fb0e65faf21fa1c4
SHA256

c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce
SHA512

5a32b7ffafa3824bd4b17568f0c7005059db293b7b866f62647f464ffe907973a75eec83d7d5712cceb171c4e0596064b0d6845ff3bc77d0f38853f1ba65662c
SSDEEP

49152:jcmY/tXt2PWRs6CE3jLbO9Rs6CE3jLbOOv+m3Al6KQ7MX8OeHgGKeJPxDiOCe+Ef:UtpRs6CE3jLbO9Rs6CE3jLbOOP3TKQ71

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2608	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	30
PID 2764 wrote to memory of 2608	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	30
PID 2764 wrote to memory of 2608	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	30
PID 2764 wrote to memory of 2608	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	30
PID 2764 wrote to memory of 2944	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	31
PID 2764 wrote to memory of 2944	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	31
PID 2764 wrote to memory of 2944	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	31
PID 2764 wrote to memory of 2944	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	31
PID 2764 wrote to memory of 2920	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	32
PID 2764 wrote to memory of 2920	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	32
PID 2764 wrote to memory of 2920	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	32
PID 2764 wrote to memory of 2920	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	32
PID 2764 wrote to memory of 2688	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	33
PID 2764 wrote to memory of 2688	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	33
PID 2764 wrote to memory of 2688	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	33
PID 2764 wrote to memory of 2688	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	33
PID 2764 wrote to memory of 2356	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	34
PID 2764 wrote to memory of 2356	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	34
PID 2764 wrote to memory of 2356	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	34
PID 2764 wrote to memory of 2356	2764	c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe	34

C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
"C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
  "{path}"
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
  "{path}"
  2⤵
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
  "{path}"
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
  "{path}"
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\c4ea0fcc647d3c244fb70dc5081a489fc60bbed7e5d62f622436b0331e5bd0ce.exe
  "{path}"
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-54-0x0000000073C80000-0x000000007436E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-53-0x0000000000220000-0x0000000000456000-memory.dmp

Filesize
2.2MB

Download
memory/2764-55-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2764-56-0x0000000073C80000-0x000000007436E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-57-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2764-58-0x0000000000640000-0x0000000000654000-memory.dmp

Filesize
80KB

Download
memory/2764-59-0x0000000008320000-0x00000000084C4000-memory.dmp

Filesize
1.6MB

Download
memory/2764-60-0x0000000005F30000-0x0000000006084000-memory.dmp

Filesize
1.3MB

Download
memory/2764-61-0x0000000073C80000-0x000000007436E000-memory.dmp

Filesize
6.9MB

Download