91519fe76e188dd8d57d221cf391fbe4b716646c8a73d3d2b96e0b270e7f07b7

General

Target

46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
Size

762KB
MD5

1a01797e5fa2117626317413590140fb
SHA1

c0a27e1f661fad26842e6eb22d6223fc7f2d9575
SHA256

46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777
SHA512

e2c6691e11aad243b7c3392be66ecd86243ded1a9b2722b7c646936b01f54371a90674b47bc8b9636d85485a96cfaad964c5c3af310e92fb496e0cc5cb73854c
SSDEEP

12288:2fAZfcahsQmcEOo7e0oLt4qm93kejEFbJi3JN//3yoCmwzXyd3FFvYpZH4EYmb:2eo7RgCUejEE7//yoCRMYkEJ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2700	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	28
PID 1988 wrote to memory of 2700	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	28
PID 1988 wrote to memory of 2700	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	28
PID 1988 wrote to memory of 2700	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	28
PID 1988 wrote to memory of 2704	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	29
PID 1988 wrote to memory of 2704	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	29
PID 1988 wrote to memory of 2704	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	29
PID 1988 wrote to memory of 2704	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	29
PID 1988 wrote to memory of 3052	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	30
PID 1988 wrote to memory of 3052	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	30
PID 1988 wrote to memory of 3052	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	30
PID 1988 wrote to memory of 3052	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	30
PID 1988 wrote to memory of 2956	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	31
PID 1988 wrote to memory of 2956	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	31
PID 1988 wrote to memory of 2956	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	31
PID 1988 wrote to memory of 2956	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	31
PID 1988 wrote to memory of 2056	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	32
PID 1988 wrote to memory of 2056	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	32
PID 1988 wrote to memory of 2056	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	32
PID 1988 wrote to memory of 2056	1988	46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe	32

C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
"C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
  "C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
  "C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
  "C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
  "C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe
  "C:\Users\Admin\AppData\Local\Temp\46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777.exe"
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x00000000008F0000-0x00000000009B4000-memory.dmp

Filesize
784KB

Download
memory/1988-1-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/1988-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1988-4-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/1988-5-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1988-6-0x0000000004C30000-0x0000000004C90000-memory.dmp

Filesize
384KB

Download
memory/1988-7-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads