b65ce1ee7322dba6d7ccab24f907b5c94d0448a23a1110db597a39135c8d977d

General

Target

dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
Size

598KB
MD5

aa504fa4dc0c6c5fb21aeda36579a853
SHA1

3e9b482c60e579d0edc2ea6e518cc82a509eacb3
SHA256

dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e
SHA512

49e882e82297aaeee133b5bea2db83bfc16dd5bfcf46038fe41ee0a2dd4d597e6c4086f764bf8e9a69374660fffb077c21a498af209dfc292e21d1dd9b35ab6e
SSDEEP

12288:b5MYGFGbdEE5wr17nlcAo7Y3hNXYEQXDu+EUuowWLCPV:b6dFKdw1DGY3wXK4wWLC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2896	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	29
PID 2096 wrote to memory of 2896	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	29
PID 2096 wrote to memory of 2896	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	29
PID 2096 wrote to memory of 2896	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	29
PID 2096 wrote to memory of 2604	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	30
PID 2096 wrote to memory of 2604	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	30
PID 2096 wrote to memory of 2604	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	30
PID 2096 wrote to memory of 2604	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	30
PID 2096 wrote to memory of 2788	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	31
PID 2096 wrote to memory of 2788	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	31
PID 2096 wrote to memory of 2788	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	31
PID 2096 wrote to memory of 2788	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	31
PID 2096 wrote to memory of 1204	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	32
PID 2096 wrote to memory of 1204	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	32
PID 2096 wrote to memory of 1204	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	32
PID 2096 wrote to memory of 1204	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	32
PID 2096 wrote to memory of 2716	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	33
PID 2096 wrote to memory of 2716	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	33
PID 2096 wrote to memory of 2716	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	33
PID 2096 wrote to memory of 2716	2096	dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe	33

C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
"C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
  "C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
  "C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
  "C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
  "C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe
  "C:\Users\Admin\AppData\Local\Temp\dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe"
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-0-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-1-0x0000000000370000-0x000000000040C000-memory.dmp

Filesize
624KB

Download
memory/2096-2-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/2096-3-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2096-4-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-5-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/2096-6-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2096-7-0x0000000005970000-0x00000000059CA000-memory.dmp

Filesize
360KB

Download
memory/2096-8-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads