ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86

General

Target

ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
Size

631KB
MD5

ed4b8e965a5e8a2b185f38a2dc7b5c1b
SHA1

4f9a24c87e5cea08769b8ba5559c755f9a8749e6
SHA256

ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86
SHA512

60c0518c3c6436889bee9dcf1cb11db8cbfbc2ca37aea8a245c1ba18537e079ed92a99a746d6a370d315daf6d7204ea7985a86da6bc827421cdc54fdf1ffe055
SSDEEP

12288:j45+po2oQpPwiViAQZb9EuQlbmtDaB6x/rQj0fBcuCA1YDL4o:i+pJhpPwT1ZZEuQlatDaIx/rQscuDWN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

pid	process
2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

description pid process

Token: SeDebugPrivilege 2876 ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

description	pid	process
Token: SeDebugPrivilege	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
2⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
2⤵
PID:844

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
2⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
2⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
"C:\Users\Admin\AppData\Local\Temp\ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe"
2⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x0000000000390000-0x0000000000434000-memory.dmp

Filesize
656KB

Download
memory/2876-1-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2876-3-0x0000000000520000-0x0000000000538000-memory.dmp

Filesize
96KB

Download
memory/2876-4-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/2876-6-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2876-5-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2876-7-0x0000000005BA0000-0x0000000005C1C000-memory.dmp

Filesize
496KB

Download
memory/2876-8-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2876 wrote to memory of 2352	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2352	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2352	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2352	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2744	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2744	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2744	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2744	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2880	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2880	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2880	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2880	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2400	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2400	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2400	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 2400	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 844	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 844	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 844	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe
PID 2876 wrote to memory of 844	2876	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe	ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86.exe

Analysis

Sharing