65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

General

Target

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
Size

1.9MB
MD5

1b87684768db892932be3f0661c54251
SHA1

e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512

0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82
SSDEEP

24576:jx4Ul0rrIOGz9I6U7AeyGvHynlLghECQl4L529dktxtPCv1ri+J/ac//zWOYopmB:mUl0/2kHW8ECQl4wi+snopp2vQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

pid	process
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

description pid process

Token: SeDebugPrivilege 3020 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

description	pid	process
Token: SeDebugPrivilege	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:2264

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:2108

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1700

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
1⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
"C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-6-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-5-0x00000000046D0000-0x000000000471C000-memory.dmp

Filesize
304KB

Download
memory/3020-4-0x0000000002210000-0x0000000002278000-memory.dmp

Filesize
416KB

Download
memory/3020-3-0x00000000047A0000-0x00000000047E0000-memory.dmp

Filesize
256KB

Download
memory/3020-2-0x0000000004650000-0x00000000046C8000-memory.dmp

Filesize
480KB

Download
memory/3020-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-0-0x0000000000370000-0x0000000000556000-memory.dmp

Filesize
1.9MB

Download

description	pid	process	target process
PID 3020 wrote to memory of 2084	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768	3020	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

Analysis

Sharing