5abec5e92048d2cf64785ed4a873acc4fd88be7d361e47b5508753bd43eeafb2

General

Target

2d472944cce2a1a6664c29336004f22c.exe
Size

998KB
MD5

2d472944cce2a1a6664c29336004f22c
SHA1

2d88407509c184f6ea85f81910f4c81dc118499b
SHA256

5abec5e92048d2cf64785ed4a873acc4fd88be7d361e47b5508753bd43eeafb2
SHA512

b4d24ccd5a345fbcd845b7cb4176bb23e5bc42a8e1e4302ba7d2a4c67864ff7e266351e3910ba32eb4799159e3c35d7465cb4fa6fe4324255b82bed377f21cf1
SSDEEP

24576:JoFGjUhRm/dFgaK64E3MyOvAcamEe/aNF0ZoR:CFk69aK6443OYO0Noc

Score

9^/10

Malware Config

Signatures

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2212-3-0x00000000002F0000-0x0000000000302000-memory.dmp	CustAttr

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

pid	process
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe
2212	2d472944cce2a1a6664c29336004f22c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

description pid process

Token: SeDebugPrivilege 2212 2d472944cce2a1a6664c29336004f22c.exe

description	pid	process
Token: SeDebugPrivilege	2212	2d472944cce2a1a6664c29336004f22c.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
PID:364

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-1-0x0000000000310000-0x0000000000410000-memory.dmp

Filesize
1024KB

Download
memory/2212-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/2212-3-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/2212-4-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-5-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/2212-6-0x0000000005000000-0x0000000005068000-memory.dmp

Filesize
416KB

Download
memory/2212-7-0x0000000000610000-0x0000000000636000-memory.dmp

Filesize
152KB

Download
memory/2212-8-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2212 wrote to memory of 2984	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2984	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2984	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2984	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2768	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2768	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2768	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2768	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2968	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2968	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2968	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 2968	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 1400	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 1400	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 1400	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 1400	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 364	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 364	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 364	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 2212 wrote to memory of 364	2212	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads