860db7ed00b9da5574527f13741e5b154e457924f0e81da583737a1c89d68027

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3c09630c2017783600507b55437efa.exe
Size

2.6MB
MD5

5d3c09630c2017783600507b55437efa
SHA1

eeda72aa2b636f90d799c1d3e48b70cde56294a0
SHA256

860db7ed00b9da5574527f13741e5b154e457924f0e81da583737a1c89d68027
SHA512

cd24315f6a90b417a4d1fa9bbd8b7986dd0f225a4e11b8c32db1cae64e6d40e28a3637077df3b1e2cc8bab57f62c17ed7956cf021ab2d46bb9566dc8fa088021
SSDEEP

49152:UgMJE4h5PnbAZiCOGd+Eo2wgZ1YrQ6vl4arZdUWgPta:QJE43Pad82wgZ1+P1yWgV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe
2280	5d3c09630c2017783600507b55437efa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	5d3c09630c2017783600507b55437efa.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	30
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	30
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	30
PID 2280 wrote to memory of 2620	2280	5d3c09630c2017783600507b55437efa.exe	30
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	31
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	31
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	31
PID 2280 wrote to memory of 2648	2280	5d3c09630c2017783600507b55437efa.exe	31
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	32
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	32
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	32
PID 2280 wrote to memory of 2664	2280	5d3c09630c2017783600507b55437efa.exe	32
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	33
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	33
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	33
PID 2280 wrote to memory of 2708	2280	5d3c09630c2017783600507b55437efa.exe	33
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	34
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	34
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	34
PID 2280 wrote to memory of 2156	2280	5d3c09630c2017783600507b55437efa.exe	34

C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
"C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
  2⤵
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3c09630c2017783600507b55437efa.exe"
  2⤵
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000000030000-0x00000000002D8000-memory.dmp

Filesize
2.7MB

Download
memory/2280-1-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-2-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/2280-3-0x0000000000680000-0x0000000000692000-memory.dmp

Filesize
72KB

Download
memory/2280-4-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-5-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/2280-6-0x0000000005BA0000-0x0000000005D90000-memory.dmp

Filesize
1.9MB

Download
memory/2280-7-0x0000000005FE0000-0x0000000006158000-memory.dmp

Filesize
1.5MB

Download
memory/2280-8-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download