9445483350a3ed0479eed69073869e73b7837327bade374605b841a560a6ee70

General

Target

989ff52398498807cd579c9292d2ca47.exe
Size

1.0MB
MD5

989ff52398498807cd579c9292d2ca47
SHA1

26b1d6def0486063ecf91c95c1cd6966711d7655
SHA256

9445483350a3ed0479eed69073869e73b7837327bade374605b841a560a6ee70
SHA512

09a770c8cee12bd538a67d64d6f07299d8024858bd3c0e5149fd6063924f795892d10399722d68ba8b2276ca6465dea66014e4801e4abb1978ec5f8d0897a621
SSDEEP

24576:EqaPJbYNjPvZjQ5/doK64Jtfhk0zKXkA:EHPJbY1RK64JpGkA

Score

9^/10

Malware Config

Signatures

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2108-3-0x0000000000500000-0x0000000000512000-memory.dmp	CustAttr

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

989ff52398498807cd579c9292d2ca47.exe

pid	process
2108	989ff52398498807cd579c9292d2ca47.exe
2108	989ff52398498807cd579c9292d2ca47.exe
2108	989ff52398498807cd579c9292d2ca47.exe
2108	989ff52398498807cd579c9292d2ca47.exe
2108	989ff52398498807cd579c9292d2ca47.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

989ff52398498807cd579c9292d2ca47.exe

description pid process

Token: SeDebugPrivilege 2108 989ff52398498807cd579c9292d2ca47.exe

description	pid	process
Token: SeDebugPrivilege	2108	989ff52398498807cd579c9292d2ca47.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

989ff52398498807cd579c9292d2ca47.exe

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
2⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
2⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
2⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
2⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe
"C:\Users\Admin\AppData\Local\Temp\989ff52398498807cd579c9292d2ca47.exe"
2⤵
PID:3032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000000300000-0x000000000040C000-memory.dmp

Filesize
1.0MB

Download
memory/2108-1-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2108-2-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/2108-3-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/2108-4-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2108-5-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/2108-6-0x0000000005410000-0x0000000005488000-memory.dmp

Filesize
480KB

Download
memory/2108-7-0x0000000004730000-0x0000000004760000-memory.dmp

Filesize
192KB

Download
memory/2108-8-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2108 wrote to memory of 2624	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2624	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2624	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2624	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2904	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2904	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2904	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2904	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2896	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2896	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2896	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2896	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2612	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2612	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2612	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 2612	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 3032	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 3032	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 3032	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe
PID 2108 wrote to memory of 3032	2108	989ff52398498807cd579c9292d2ca47.exe	989ff52398498807cd579c9292d2ca47.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads