42389fd7b3f077c83db7ab484ba1b5c7aeb8e273c9fb377bcfc645d617abbfc3

General

Target

60e6e7371f8b2992aa00526d2a24eafb.exe
Size

45KB
MD5

60e6e7371f8b2992aa00526d2a24eafb
SHA1

b7682a287bf4ec7fc1811f6c272c1080c19ef1b9
SHA256

42389fd7b3f077c83db7ab484ba1b5c7aeb8e273c9fb377bcfc645d617abbfc3
SHA512

879db04d6354905f4cb0d956800eb601f7c67175ea7198e31514464efb5cb75c0ffaa8579238369be3db558a762ddecb2dab13df910f9373fbd128b9cc39f49a
SSDEEP

768:cnBLv16ZlR6qXnRbMLd1deM45MMjTqKBqXl75I1TOPxQkbyylG+uWDrHbWrUy:TB4jdeMqBqK4Xx5IMPrbyylBuWDrHbhy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2640	2156	60e6e7371f8b2992aa00526d2a24eafb.exe	22
PID 2156 wrote to memory of 2640	2156	60e6e7371f8b2992aa00526d2a24eafb.exe	22
PID 2156 wrote to memory of 2640	2156	60e6e7371f8b2992aa00526d2a24eafb.exe	22
PID 2640 wrote to memory of 2680	2640	cmd.exe	17
PID 2640 wrote to memory of 2680	2640	cmd.exe	17
PID 2640 wrote to memory of 2680	2640	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\60e6e7371f8b2992aa00526d2a24eafb.exe
"C:\Users\Admin\AppData\Local\Temp\60e6e7371f8b2992aa00526d2a24eafb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\cmd.exe
  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
1⤵
PID:2680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
PID:2724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
1⤵
PID:3008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
1⤵
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-53-0x00000000021E0000-0x0000000002260000-memory.dmp

Filesize
512KB

Download
memory/2156-1-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2156-2-0x00000000021E0000-0x0000000002260000-memory.dmp

Filesize
512KB

Download
memory/2156-51-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2156-0-0x000000013FC90000-0x000000013FCA0000-memory.dmp

Filesize
64KB

Download
memory/2680-12-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2680-10-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2680-7-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2680-14-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/2680-11-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/2680-9-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/2680-13-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2680-8-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2696-27-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-26-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2696-23-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/2696-21-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-22-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2696-24-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-20-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2696-25-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2724-35-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/2724-37-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2724-36-0x0000000002B14000-0x0000000002B17000-memory.dmp

Filesize
12KB

Download
memory/2724-38-0x0000000002B1B000-0x0000000002B82000-memory.dmp

Filesize
412KB

Download
memory/2724-33-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/2724-34-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2724-39-0x000007FEEEC90000-0x000007FEEF62D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-49-0x000000000297B000-0x00000000029E2000-memory.dmp

Filesize
412KB

Download
memory/3008-50-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3008-48-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-46-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3008-45-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-52-0x000007FEEE2F0000-0x000007FEEEC8D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-47-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads