845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00

General

Target

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe
Size

1.6MB
MD5

f8fcbb9dc832d62a75f5b3cf59015b05
SHA1

ad0b9d464c0ce04b7dabfb1104df10ae241b104b
SHA256

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00
SHA512

ffaafdfddd5f67b938c3adec185d18ae4b88215f6e263c656475985154cf624998e62abffa85be8916f6a93c147ba5071f192f3987312c80336b0d081cddb576
SSDEEP

24576:IxBty9XUrbcO3faYAPbXRnUgdKA026BNEam/eYeUUUJaJaGjfg71JkvG:aLuYQYAPbXRvqBNZDK1JSG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

description	pid	process	target process
PID 3188 set thread context of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

pid	process
3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe
3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

description pid process

Token: SeDebugPrivilege 3188 845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

description	pid	process
Token: SeDebugPrivilege	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe

description	pid	process	target process
PID 3188 wrote to memory of 4804	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4804	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4804	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe
PID 3188 wrote to memory of 4716	3188	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe
"C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3188-18-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-4-0x0000000004FA0000-0x0000000004FBC000-memory.dmp

Filesize
112KB

Download
memory/3188-1-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/3188-3-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/3188-20-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-5-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-6-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-24-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-10-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-12-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-14-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-16-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-2-0x0000000005030000-0x00000000050CC000-memory.dmp

Filesize
624KB

Download
memory/3188-0-0x00000000006B0000-0x0000000000848000-memory.dmp

Filesize
1.6MB

Download
memory/3188-8-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-22-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-26-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-28-0x0000000004FA0000-0x0000000004FB5000-memory.dmp

Filesize
84KB

Download
memory/3188-29-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3188-30-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3188-36-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/4716-32-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4716-33-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4716-35-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4716-31-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads