845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00

General

Target

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
Size

1.6MB
MD5

f8fcbb9dc832d62a75f5b3cf59015b05
SHA1

ad0b9d464c0ce04b7dabfb1104df10ae241b104b
SHA256

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00
SHA512

ffaafdfddd5f67b938c3adec185d18ae4b88215f6e263c656475985154cf624998e62abffa85be8916f6a93c147ba5071f192f3987312c80336b0d081cddb576
SSDEEP

24576:IxBty9XUrbcO3faYAPbXRnUgdKA026BNEam/eYeUUUJaJaGjfg71JkvG:aLuYQYAPbXRvqBNZDK1JSG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28
PID 1096 wrote to memory of 2780	1096	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
"C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-13-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-2-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/1096-1-0x0000000001230000-0x00000000013C8000-memory.dmp

Filesize
1.6MB

Download
memory/1096-3-0x00000000004C0000-0x00000000004DC000-memory.dmp

Filesize
112KB

Download
memory/1096-5-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-25-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-27-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-28-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1096-29-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1096-23-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-21-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-19-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-17-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-15-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-4-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-0-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/1096-7-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-9-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/1096-40-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/1096-11-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/2780-34-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-33-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-41-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-32-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-31-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-39-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-37-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-42-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2780-30-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads