238ff98521340c23ec2b36fb37d21bb66fec858874ca34e62859a20ad387948c

General

Target

fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
Size

686KB
MD5

5a663a122c4d05a04fbe40571d2271aa
SHA1

f0e47c9a3b2bda06c706cb680f6f2efadb201520
SHA256

fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948
SHA512

a421723519a558abad954c13be517a3ec3ff945c197c7715c6b1746a7dd54a436a2846a2334651f4bfe19ad02c5a8a04809daa4d61e3c61d6490c5e3c7d67c06
SSDEEP

12288:S0gM1iEpS4TRIBS0eVR8IwE1WqoPTvSFxU5LlbI:SiRp3T+GXDXoPTvIALlbI

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

pid	process
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

description pid process

Token: SeDebugPrivilege 1772 fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

description	pid	process
Token: SeDebugPrivilege	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
2⤵
PID:2700

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
2⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
2⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
2⤵
PID:2796

C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
"C:\Users\Admin\AppData\Local\Temp\fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe"
2⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-1-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/1772-0-0x00000000003F0000-0x00000000004A2000-memory.dmp

Filesize
712KB

Download
memory/1772-2-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1772-3-0x00000000005F0000-0x00000000005FE000-memory.dmp

Filesize
56KB

Download
memory/1772-4-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/1772-5-0x0000000004D80000-0x0000000004DE0000-memory.dmp

Filesize
384KB

Download
memory/1772-6-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/1772-7-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1772-8-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 1772 wrote to memory of 2700	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2700	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2700	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2700	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2768	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2768	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2768	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2768	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2804	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2804	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2804	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2804	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2796	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2796	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2796	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2796	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2832	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2832	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2832	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe
PID 1772 wrote to memory of 2832	1772	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe	fde758d52b541296b4a6f68c65332fb1ae491b7d92723faafd252b3f46d9c948.exe

Analysis

Sharing