c0539fd02ca0184925a932a9e926c681dc9c81b5de4624250f2dd885ca5c4763

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecdf7acb35e4268bcafb03b8af12f659.exe
Size

686KB
MD5

ecdf7acb35e4268bcafb03b8af12f659
SHA1

93b0d892bd3fbb7d3d9efb69fffdc060159d4536
SHA256

c0539fd02ca0184925a932a9e926c681dc9c81b5de4624250f2dd885ca5c4763
SHA512

5cd325c7a0a47921e940480c4e3f983b5b56a2906639e6f2a67d3264e039f06034d286f68e36a1b1ae7642d1ac0e274283d5d45381cede14ba83177355f1017d
SSDEEP

12288:UzRlcffXwJsWFAFnjJPQJq+6byL3z5SjMa1jkSC9U:ujB0JYcAa1S

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe
2224	ecdf7acb35e4268bcafb03b8af12f659.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	ecdf7acb35e4268bcafb03b8af12f659.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2216	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	28
PID 2224 wrote to memory of 2216	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	28
PID 2224 wrote to memory of 2216	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	28
PID 2224 wrote to memory of 2216	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	28
PID 2224 wrote to memory of 2812	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	29
PID 2224 wrote to memory of 2812	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	29
PID 2224 wrote to memory of 2812	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	29
PID 2224 wrote to memory of 2812	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	29
PID 2224 wrote to memory of 2228	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	30
PID 2224 wrote to memory of 2228	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	30
PID 2224 wrote to memory of 2228	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	30
PID 2224 wrote to memory of 2228	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	30
PID 2224 wrote to memory of 2448	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	31
PID 2224 wrote to memory of 2448	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	31
PID 2224 wrote to memory of 2448	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	31
PID 2224 wrote to memory of 2448	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	31
PID 2224 wrote to memory of 2440	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	32
PID 2224 wrote to memory of 2440	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	32
PID 2224 wrote to memory of 2440	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	32
PID 2224 wrote to memory of 2440	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	32
PID 2224 wrote to memory of 1908	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	33
PID 2224 wrote to memory of 1908	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	33
PID 2224 wrote to memory of 1908	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	33
PID 2224 wrote to memory of 1908	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	33
PID 2224 wrote to memory of 2984	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	34
PID 2224 wrote to memory of 2984	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	34
PID 2224 wrote to memory of 2984	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	34
PID 2224 wrote to memory of 2984	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	34
PID 2224 wrote to memory of 2816	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	35
PID 2224 wrote to memory of 2816	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	35
PID 2224 wrote to memory of 2816	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	35
PID 2224 wrote to memory of 2816	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	35
PID 2224 wrote to memory of 2352	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	37
PID 2224 wrote to memory of 2352	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	37
PID 2224 wrote to memory of 2352	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	37
PID 2224 wrote to memory of 2352	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	37
PID 2224 wrote to memory of 2384	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	36
PID 2224 wrote to memory of 2384	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	36
PID 2224 wrote to memory of 2384	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	36
PID 2224 wrote to memory of 2384	2224	ecdf7acb35e4268bcafb03b8af12f659.exe	36

C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
"C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  C:\Users\Admin\AppData\Local\Temp\ecdf7acb35e4268bcafb03b8af12f659.exe
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000380000-0x0000000000432000-memory.dmp

Filesize
712KB

Download
memory/2224-1-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-2-0x00000000008D0000-0x0000000000910000-memory.dmp

Filesize
256KB

Download
memory/2224-3-0x0000000000340000-0x0000000000386000-memory.dmp

Filesize
280KB

Download
memory/2224-4-0x0000000000450000-0x0000000000484000-memory.dmp

Filesize
208KB

Download
memory/2224-5-0x0000000000710000-0x000000000075C000-memory.dmp

Filesize
304KB

Download
memory/2224-6-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download