d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
Size

608KB
MD5

a91a8edf24d47caa5467f0edc250d0ff
SHA1

98041ec6166c2966f676cbc8a1f1d42fec947c00
SHA256

d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e
SHA512

0dac8878aaf2abe4e20f3884c0ffcff78150898d807468d152e207e439ff6516f98ac7f370fab34f5c2e285c2e1bcccbfd918430ca1b55997d54d279a50a534c
SSDEEP

12288:x4Vv6NZVslFs1JABNmJ4lnZxGA7sRLwQz8XdgTDdik5dCNd:6CvVsoABNmWnmA7sRLwjeTxrUd

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4772	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
4772	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3092	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	94
PID 4284 wrote to memory of 3092	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	94
PID 4284 wrote to memory of 3092	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	94
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95
PID 4284 wrote to memory of 4772	4284	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	95

C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
"C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
  "C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe"
  2⤵
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
  "C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-8-0x0000000006830000-0x0000000006842000-memory.dmp

Filesize
72KB

Download
memory/4284-10-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/4284-2-0x0000000005690000-0x0000000005C34000-memory.dmp

Filesize
5.6MB

Download
memory/4284-9-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/4284-4-0x0000000005C40000-0x0000000005F94000-memory.dmp

Filesize
3.3MB

Download
memory/4284-5-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/4284-6-0x0000000005310000-0x000000000531A000-memory.dmp

Filesize
40KB

Download
memory/4284-7-0x0000000005410000-0x00000000054AC000-memory.dmp

Filesize
624KB

Download
memory/4284-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/4284-0-0x0000000000690000-0x000000000072E000-memory.dmp

Filesize
632KB

Download
memory/4284-3-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/4284-11-0x00000000068D0000-0x00000000068D8000-memory.dmp

Filesize
32KB

Download
memory/4284-12-0x00000000068E0000-0x00000000068EA000-memory.dmp

Filesize
40KB

Download
memory/4284-13-0x0000000006E40000-0x0000000006EB4000-memory.dmp

Filesize
464KB

Download
memory/4284-17-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/4772-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4772-14-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4772-18-0x00000000011C0000-0x000000000150A000-memory.dmp

Filesize
3.3MB

Download
memory/4772-19-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download