e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933

General

Target

e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
Size

941KB
MD5

00e2bb2624c734506abe9d2c5bd89ade
SHA1

fe9ce13b890558a8c85c88cddafdc07fc943012b
SHA256

e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933
SHA512

9f750b7256fbef4e10c4566505c7482df14087550f7772bd6dafee450852d148f59815e6dcac51e7e6086c4a7f6d6d9e19a26baa43c6e5af0413402b221ff895
SSDEEP

24576:SFtD/619Y/FCmKv9XHzrxHoojg6RDJ23wHENt:q6b6FC31HxFcWUr

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2480	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
2480	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2908	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	28
PID 2664 wrote to memory of 2908	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	28
PID 2664 wrote to memory of 2908	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	28
PID 2664 wrote to memory of 2908	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	28
PID 2664 wrote to memory of 2876	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	32
PID 2664 wrote to memory of 2876	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	32
PID 2664 wrote to memory of 2876	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	32
PID 2664 wrote to memory of 2876	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	32
PID 2664 wrote to memory of 2400	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	30
PID 2664 wrote to memory of 2400	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	30
PID 2664 wrote to memory of 2400	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	30
PID 2664 wrote to memory of 2400	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	30
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2664 wrote to memory of 2480	2664	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	29
PID 2480 wrote to memory of 2844	2480	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	31
PID 2480 wrote to memory of 2844	2480	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	31
PID 2480 wrote to memory of 2844	2480	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	31
PID 2480 wrote to memory of 2844	2480	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	31

C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
"C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
  "C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe"
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
  "C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 36
    3⤵
    - Program crash
    PID:2844
- C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
  "C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe"
  2⤵
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
  "C:\Users\Admin\AppData\Local\Temp\e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe"
  2⤵
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-16-0x0000000000780000-0x0000000000A83000-memory.dmp

Filesize
3.0MB

Download
memory/2480-9-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-6-0x0000000005220000-0x000000000529E000-memory.dmp

Filesize
504KB

Download
memory/2664-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-14-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-5-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2664-4-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2664-3-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download
memory/2664-2-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/2664-0-0x0000000000D00000-0x0000000000DF2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing