a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79

General

Target

a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
Size

704KB
MD5

326f131c3a7dcfb88881854fa5faad2e
SHA1

c2b4fbe4687c10b6c92acaf89e1f94ce60a253a5
SHA256

a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79
SHA512

c1f599ee8fbc0dc6e14722d02cf4cb5fa8fc5cf038bd6135020ebc1c4998a56f2b404bd6172e51fe36976de78f4706a0cad5655c0a35dc1eb1464238e26a1bb7
SSDEEP

12288:4qfLYYZXTy4pgtcn6mblK18zrBE6NMpBuoMXo6TUr5wdFkMgzt8ro+:rXTjpgtOpKep9NUuocZBPB

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

pid	process
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

description pid process

Token: SeDebugPrivilege 2424 a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

description	pid	process
Token: SeDebugPrivilege	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
2⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
2⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
2⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
2⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
"C:\Users\Admin\AppData\Local\Temp\a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe"
2⤵
PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-1-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-0-0x00000000003B0000-0x0000000000466000-memory.dmp

Filesize
728KB

Download
memory/2424-2-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2424-3-0x0000000000390000-0x00000000003A8000-memory.dmp

Filesize
96KB

Download
memory/2424-4-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2424-5-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2424-6-0x00000000001C0000-0x000000000023A000-memory.dmp

Filesize
488KB

Download
memory/2424-7-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-8-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2424-9-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2424 wrote to memory of 2308	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2308	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2308	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2308	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1904	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1904	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1904	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1904	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1336	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1336	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1336	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 1336	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2096	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2096	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2096	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2096	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2316	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2316	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2316	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe
PID 2424 wrote to memory of 2316	2424	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe	a6bf938384c116808ee849e15dfe627610056c03bf1626268bc88d25d35cfe79.exe

Analysis

Sharing