52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2

General

Target

52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
Size

1.3MB
MD5

c3b96fdd29b7cb0f7d43a5ebb6b4abea
SHA1

560e2c62fc063dd02ac1f03373864dd78234522f
SHA256

52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2
SHA512

18ea0a3f5bb95e49f66a1511eeffbe32a7e51e98119f7d4979ec898ac67bdb866bd9234560dfd85adc67b5586517398a96b7033db391ba2c805f1994b02af469
SSDEEP

24576:tVlDf7kW8Y4WkEpH4f6vUZKooo5/TODSVXT5XkSgvya:jlkW8YJkEpHzooopXT5Xk/v1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe

pid	process
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe

description	pid	process
Token: SeDebugPrivilege	1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
Token: SeDebugPrivilege	1232	52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe

C:\Users\Admin\AppData\Local\Temp\52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe
"C:\Users\Admin\AppData\Local\Temp\52ffd33eb06321f8f20d2fce86bd6fcfc797b2e2338e0729e1ee05509e4f1cc2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x000001C2947E0000-0x000001C294814000-memory.dmp

Filesize
208KB

Download
memory/1232-1-0x00007FFD2CD70000-0x00007FFD2D831000-memory.dmp

Filesize
10.8MB

Download
memory/1232-2-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download
memory/1232-3-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download
memory/1232-4-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download
memory/1232-5-0x000001C294EA0000-0x000001C294EA8000-memory.dmp

Filesize
32KB

Download
memory/1232-6-0x000001C2B2BD0000-0x000001C2B2C08000-memory.dmp

Filesize
224KB

Download
memory/1232-7-0x000001C2AD380000-0x000001C2AD38E000-memory.dmp

Filesize
56KB

Download
memory/1232-20-0x00007FFD2CD70000-0x00007FFD2D831000-memory.dmp

Filesize
10.8MB

Download
memory/1232-21-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download
memory/1232-22-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download
memory/1232-23-0x000001C2AD3E0000-0x000001C2AD3F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing