791831034a36bfa2213940dfd9ffc6cb9dc0660ecd1a6d8de3565260c9cec8d2

General

Target

75048b2cf840c20b06c3b36ccc77b7af.exe
Size

139KB
MD5

75048b2cf840c20b06c3b36ccc77b7af
SHA1

a6b402cad583c3fb402ea205e6129a8ba905990b
SHA256

791831034a36bfa2213940dfd9ffc6cb9dc0660ecd1a6d8de3565260c9cec8d2
SHA512

ea029284f31fd44ed023b1fb3f7c0541943ae507914eeac6e4a1ed70ba063a9e4ac5adae92ed8db0c1d721653fcb58244ecd24d2d89865ae6ecb5893506ed50e
SSDEEP

3072:IV2MAwtwxC451FTDQ023yHav4gFGMHJeGrkW2gYmY:IMec7MyHaAgFGMHJeDW2g

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75048b2cf840c20b06c3b36ccc77b7af.exe

pid process

3016 75048b2cf840c20b06c3b36ccc77b7af.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

75048b2cf840c20b06c3b36ccc77b7af.exe

pid	process
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe
3016	75048b2cf840c20b06c3b36ccc77b7af.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75048b2cf840c20b06c3b36ccc77b7af.exe

description pid process

Token: SeDebugPrivilege 3016 75048b2cf840c20b06c3b36ccc77b7af.exe

description	pid	process
Token: SeDebugPrivilege	3016	75048b2cf840c20b06c3b36ccc77b7af.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75048b2cf840c20b06c3b36ccc77b7af.exe

description	pid	process	target process
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 372	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	wininit.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 384	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	csrss.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 420	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	winlogon.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 464	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	services.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 476	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsass.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 484	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	lsm.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 596	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 672	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 756	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe
PID 3016 wrote to memory of 800	3016	75048b2cf840c20b06c3b36ccc77b7af.exe	svchost.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:964

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1044

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:476

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2504

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\75048b2cf840c20b06c3b36ccc77b7af.exe
"C:\Users\Admin\AppData\Local\Temp\75048b2cf840c20b06c3b36ccc77b7af.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x0000000001000000-0x0000000001027000-memory.dmp

Filesize
156KB

Download
memory/3016-1-0x00000000775DF000-0x00000000775E0000-memory.dmp

Filesize
4KB

Download
memory/3016-2-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/3016-3-0x0000000001000000-0x0000000001027000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads