860db7ed00b9da5574527f13741e5b154e457924f0e81da583737a1c89d68027

General

Target

5d3c09630c2017783600507b55437efa.exe
Size

2.6MB
MD5

5d3c09630c2017783600507b55437efa
SHA1

eeda72aa2b636f90d799c1d3e48b70cde56294a0
SHA256

860db7ed00b9da5574527f13741e5b154e457924f0e81da583737a1c89d68027
SHA512

cd24315f6a90b417a4d1fa9bbd8b7986dd0f225a4e11b8c32db1cae64e6d40e28a3637077df3b1e2cc8bab57f62c17ed7956cf021ab2d46bb9566dc8fa088021
SSDEEP

49152:UgMJE4h5PnbAZiCOGd+Eo2wgZ1YrQ6vl4arZdUWgPta:QJE43Pad82wgZ1+P1yWgV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

5d3c09630c2017783600507b55437efa.exe

pid	process
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d3c09630c2017783600507b55437efa.exe

description pid process

Token: SeDebugPrivilege 2280 5d3c09630c2017783600507b55437efa.exe

description	pid	process
Token: SeDebugPrivilege	2280	5d3c09630c2017783600507b55437efa.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5d3c09630c2017783600507b55437efa.exe

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
2⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
2⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
2⤵
PID:2664

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
2⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
2⤵
PID:2156

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000000030000-0x00000000002D8000-memory.dmp

Filesize
2.7MB

Download
memory/2280-1-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-2-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/2280-3-0x0000000000680000-0x0000000000692000-memory.dmp

Filesize
72KB

Download
memory/2280-4-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-5-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/2280-6-0x0000000005BA0000-0x0000000005D90000-memory.dmp

Filesize
1.9MB

Download
memory/2280-7-0x0000000005FE0000-0x0000000006158000-memory.dmp

Filesize
1.5MB

Download
memory/2280-8-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	5d3c09630c2017783600507b55437efa.exe

Analysis

Sharing