8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cd889e65235a00e96a92e4304307f53.exe
Size 969KB
Sample230823-gnk29sbf7x
SHA256 8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
MD5 9cd889e65235a00e96a92e4304307f53
SHA1 b4fbf0aab8d2695231ee54615c60a917bf9ad2cd
SHA512 7a7b4e48f9145e0e3f34eb321f8d62488ded7fd5e34263beeb6ae16af53fa3b17f19617ea29af6f6ad38bc3b264c7ac0333ca82604bb56a8b0928630e62c670e
SSDEEP 24576:NS9lCe9qhJ4pdsEQ2ZM5R1HuimkVZPmkgPV4dfTL4:SlCe9qhJ4peLgMr5THLekgOZk
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2312	9cd889e65235a00e96a92e4304307f53.exe
2312	9cd889e65235a00e96a92e4304307f53.exe
2312	9cd889e65235a00e96a92e4304307f53.exe
2312	9cd889e65235a00e96a92e4304307f53.exe
1472	9cd889e65235a00e96a92e4304307f53.exe
1472	9cd889e65235a00e96a92e4304307f53.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	9cd889e65235a00e96a92e4304307f53.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1196	2312	9cd889e65235a00e96a92e4304307f53.exe	90
PID 2312 wrote to memory of 1196	2312	9cd889e65235a00e96a92e4304307f53.exe	90
PID 2312 wrote to memory of 1196	2312	9cd889e65235a00e96a92e4304307f53.exe	90
PID 2312 wrote to memory of 4208	2312	9cd889e65235a00e96a92e4304307f53.exe	91
PID 2312 wrote to memory of 4208	2312	9cd889e65235a00e96a92e4304307f53.exe	91
PID 2312 wrote to memory of 4208	2312	9cd889e65235a00e96a92e4304307f53.exe	91
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92
PID 2312 wrote to memory of 1472	2312	9cd889e65235a00e96a92e4304307f53.exe	92

C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe
"C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe
  "C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe"
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe
  "C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe"
  2⤵
  PID:4208
- C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe
  "C:\Users\Admin\AppData\Local\Temp\9cd889e65235a00e96a92e4304307f53.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-142-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1472-146-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1472-145-0x0000000001720000-0x0000000001A6A000-memory.dmp

Download

memory/2312-136-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/2312-137-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2312-138-0x00000000058D0000-0x00000000058DA000-memory.dmp

Download

memory/2312-139-0x0000000005B50000-0x0000000005BEC000-memory.dmp

Download

memory/2312-140-0x00000000743E0000-0x0000000074B90000-memory.dmp

Download

memory/2312-141-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2312-134-0x00000000743E0000-0x0000000074B90000-memory.dmp

Download

memory/2312-144-0x00000000743E0000-0x0000000074B90000-memory.dmp

Download

memory/2312-135-0x0000000005ED0000-0x0000000006474000-memory.dmp

Download

memory/2312-133-0x0000000000DD0000-0x0000000000EC8000-memory.dmp

Download