db2a2d7c0772591199f7d3be76fd05031487f14b888efaa626d167397130c86b

General

Target

cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
Size

738KB
MD5

33a2aca5866de0f687e0d5d64c1feb9b
SHA1

42c8a406496525574a3954a219968db17eb7877f
SHA256

cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4
SHA512

0df31bd83fb732f9c228807b1ff0897a1f58198a3d9baf544eec95dbae2d19de490a47e2217455438eed4132fb6a5b5f834e74c8210d7741914cc74e4fd65cb6
SSDEEP

12288:kI2ICYm2L/c37RaJFheLHUvGnJ6zsCMgzF+Nm3jZ738FQTft:AX27c3yQL0vyljgzAwjZj8C

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

pid	process
3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

description pid process

Token: SeDebugPrivilege 3016 cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

description	pid	process
Token: SeDebugPrivilege	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
2⤵
PID:2276

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
2⤵
PID:2068

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
2⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
2⤵
PID:936

C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe"
2⤵
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x00000000003F0000-0x00000000004AE000-memory.dmp

Filesize
760KB

Download
memory/3016-1-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/3016-2-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/3016-3-0x00000000021E0000-0x00000000021F6000-memory.dmp

Filesize
88KB

Download
memory/3016-4-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/3016-5-0x00000000043E0000-0x00000000043EA000-memory.dmp

Filesize
40KB

Download
memory/3016-6-0x00000000051C0000-0x0000000005246000-memory.dmp

Filesize
536KB

Download
memory/3016-7-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 3016 wrote to memory of 2276	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2276	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2276	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2276	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2068	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2068	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2068	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2068	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2268	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2268	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2268	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2268	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 936	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 936	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 936	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 936	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2328	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2328	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2328	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe
PID 3016 wrote to memory of 2328	3016	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe	cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

Analysis

Sharing