0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8

General

Target

0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
Size

680KB
MD5

356f615eb12a2da9a61483e51a42ceec
SHA1

6acd233bd9cbcf3a0e665a88de9647f633da6c6a
SHA256

0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8
SHA512

194b5e49c0d06dc38cde815347ac7c232621d3338b158fba9c81834d14f580a7825a81122ec78b6ddcf8b3c2831d070677c69a464501261cae2f4a6793ea8565
SSDEEP

12288:pGbiSAx5PWPQA0pWlBbsn3EWdzpIbXKL31SM1XlLSBsjzC0KeHoWbVtQ/tE:pG7Ax5uPg5+W3kMSBsjHR5tQVE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2728	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	30
PID 2124 wrote to memory of 2728	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	30
PID 2124 wrote to memory of 2728	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	30
PID 2124 wrote to memory of 2728	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	30
PID 2124 wrote to memory of 1644	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	31
PID 2124 wrote to memory of 1644	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	31
PID 2124 wrote to memory of 1644	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	31
PID 2124 wrote to memory of 1644	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	31
PID 2124 wrote to memory of 2696	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	32
PID 2124 wrote to memory of 2696	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	32
PID 2124 wrote to memory of 2696	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	32
PID 2124 wrote to memory of 2696	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	32
PID 2124 wrote to memory of 2580	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	33
PID 2124 wrote to memory of 2580	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	33
PID 2124 wrote to memory of 2580	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	33
PID 2124 wrote to memory of 2580	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	33
PID 2124 wrote to memory of 2456	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	34
PID 2124 wrote to memory of 2456	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	34
PID 2124 wrote to memory of 2456	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	34
PID 2124 wrote to memory of 2456	2124	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	34

C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000390000-0x000000000043E000-memory.dmp

Filesize
696KB

Download
memory/2124-1-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2124-2-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2124-3-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/2124-4-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2124-5-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2124-6-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2124-7-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/2124-8-0x0000000004FB0000-0x000000000502A000-memory.dmp

Filesize
488KB

Download
memory/2124-9-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads