a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92

General

Target

a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
Size

632KB
MD5

bdf17bc9572ea9688f7197170c9e8ba5
SHA1

51b46673afb0cc49ef3159c2f6b026832b4ceeef
SHA256

a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92
SHA512

42217e461b74b96805b8a0cfb4733dca210485dfdc6f44bf578ccd50d16ced83e2a0ba0bda3426671b51368d9508f7fa397653c5db4881cf76adcc39566f82eb
SSDEEP

12288:645+po2mrMbymdO0XIgEPtYz5w62FEASUjJq4tiNF/3M3Guc817:Z+pJrrdO04gwtYz5wrF4UjY48NF/Tuc8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

pid	process
2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

description pid process

Token: SeDebugPrivilege 2224 a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

description	pid	process
Token: SeDebugPrivilege	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
2⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
2⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
2⤵
PID:2124

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
2⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
"C:\Users\Admin\AppData\Local\Temp\a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe"
2⤵
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000360000-0x0000000000402000-memory.dmp

Filesize
648KB

Download
memory/2224-1-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2224-3-0x0000000000480000-0x0000000000498000-memory.dmp

Filesize
96KB

Download
memory/2224-4-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2224-5-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2224-6-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2224-7-0x0000000005BF0000-0x0000000005C6C000-memory.dmp

Filesize
496KB

Download
memory/2224-8-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2224 wrote to memory of 2404	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2404	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2404	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2404	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2036	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2036	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2036	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2036	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2124	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2124	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2124	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2124	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2040	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2040	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2040	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2040	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2640	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2640	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2640	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
PID 2224 wrote to memory of 2640	2224	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe	a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe

Analysis

Sharing