3ef621b8c2e5c5987eca24c35045f5f228e7c26a04314a0b08c3fea85d2a1b0a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdbf35ad1de61e60d2aef9a0960e56a2.exe
Size

137KB
MD5

bdbf35ad1de61e60d2aef9a0960e56a2
SHA1

5b76db5aae80e27e455545921889b3ed7462498c
SHA256

3ef621b8c2e5c5987eca24c35045f5f228e7c26a04314a0b08c3fea85d2a1b0a
SHA512

6d06093b85b1a85ba881e822fcb8112b5df4698b7177a77d7c10878e24231dfee980c35bcba664cea4a56eab3c59f14e2bfbe3289a0986396a594971a753b387
SSDEEP

3072:N0IGsxTN4flZyhY2YqzYg2sEbLR9kfkSMzFkaW:mRyhY2zCLvSMZkaW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe
2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 384	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	3
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 392	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	4
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 432	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	5
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 476	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	6
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 492	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	7
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 500	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	8
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 604	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	9
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 684	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	10
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 760	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	11
PID 2192 wrote to memory of 820	2192	bdbf35ad1de61e60d2aef9a0960e56a2.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1820
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:760
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:240
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:296
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1044
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2136
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2244
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\bdbf35ad1de61e60d2aef9a0960e56a2.exe
  "C:\Users\Admin\AppData\Local\Temp\bdbf35ad1de61e60d2aef9a0960e56a2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-1-0x00000000002D0000-0x00000000002F9000-memory.dmp

Filesize
164KB

Download
memory/2192-2-0x00000000002D0000-0x00000000002F9000-memory.dmp

Filesize
164KB

Download
memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download