c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850

General

Target

c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe
Size

5.7MB
MD5

ef618119067dbb8f13e79c606a3787c1
SHA1

8f499f015e638dcc6c471f1a33de3f1131e47a98
SHA256

c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850
SHA512

2f29fa4ef02d02e16255bf532f8503e393b1afc26fc8142e095b79cb27ffb16ba353b7d6da2472ca70d8aff654155d8285a579fdd18246e3baf57c47cd09cf5a
SSDEEP

24576:2lTnR0S85UKIlfGqg8Bbw53AjRywdEeiNBMH:qG5UZ08twqjjEe8U

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe
1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2844	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	28
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29
PID 1916 wrote to memory of 2424	1916	c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe	29

C:\Users\Admin\AppData\Local\Temp\c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe
"C:\Users\Admin\AppData\Local\Temp\c75544560df66ea7f8fa020b1924e7356d6dd9a3b3920194bf7555baece4c850.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-0-0x0000000000850000-0x00000000008FC000-memory.dmp

Filesize
688KB

Download
memory/1916-1-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-2-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/1916-3-0x0000000000680000-0x00000000006FE000-memory.dmp

Filesize
504KB

Download
memory/1916-4-0x0000000000780000-0x00000000007FE000-memory.dmp

Filesize
504KB

Download
memory/1916-5-0x00000000020D0000-0x000000000213E000-memory.dmp

Filesize
440KB

Download
memory/1916-6-0x0000000000800000-0x000000000084C000-memory.dmp

Filesize
304KB

Download
memory/1916-19-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-11-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-9-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-17-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2424-8-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing