201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996

General

Target

201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
Size

635KB
MD5

acd04306f9838fb1b154c2a42e072ef5
SHA1

5fb94f6e77ecd9f3f3baa523f332bd5c75db73ac
SHA256

201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996
SHA512

26eca6161dc3ae0ff08791c9f76bffc86a543bc1a9115e87417a4abad56762dabe8a7c6f80d694ac414fcd0257e47fc9eaac401aaaaafff0922fcec28dacdf93
SSDEEP

12288:+a45+po2d1pgIyS8+YI6fELRCQce6S5cJc4ZuNqFsU8dZE:+5+pJrISm3sLRCHFMcC3NksU8dS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

pid	process
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

description pid process

Token: SeDebugPrivilege 2916 201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

description	pid	process
Token: SeDebugPrivilege	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
2⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
2⤵
PID:2332

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
2⤵
PID:2228

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
2⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
"C:\Users\Admin\AppData\Local\Temp\201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe"
2⤵
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-0-0x00000000003F0000-0x0000000000494000-memory.dmp

Filesize
656KB

Download
memory/2916-2-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2916-3-0x0000000000560000-0x0000000000578000-memory.dmp

Filesize
96KB

Download
memory/2916-4-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/2916-5-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/2916-6-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2916-7-0x0000000004C60000-0x0000000004CDC000-memory.dmp

Filesize
496KB

Download
memory/2916-8-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2916 wrote to memory of 2112	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2112	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2112	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2112	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2332	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2332	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2332	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2332	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2228	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2228	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2228	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2228	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2912	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2912	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2912	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2912	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2816	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2816	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2816	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe
PID 2916 wrote to memory of 2816	2916	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe	201b3143e9e4ba28c3dacba060233db540cce934825d05f91165bc50a3e2c996exe.exe

Analysis

Sharing