408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c

General

Target

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
Size

996KB
MD5

0f590a7d7c99e395fa9aaa1159e00fb3
SHA1

58322ce759d00892e146a499456492f19b03ede0
SHA256

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c
SHA512

27c402a22a4cc414a53584a55a87e6d314c62f8958ee8ee690020aaa762c1aede794877cdc37806c9f1c3aa6d9dd5e675e10bc9efcf567987f86cf1ede4e1c59
SSDEEP

24576:Ko5SLBTIjiK1MweZsLuI2/OFea6hPj42nqxvS:z5StsR1MwiOFGctxv

Score

9^/10

Malware Config

Signatures

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-5-0x00000000004A0000-0x00000000004AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2324 schtasks.exe

pid	process
2324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exepowershell.exe

pid	process
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe

C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
"C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fmduzErmJdOHa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fmduzErmJdOHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp427C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
  "C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
  "C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
  "C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
  "C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
  2⤵
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
  "C:\Users\Admin\AppData\Local\Temp\408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe"
  2⤵
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp427C.tmp

Filesize
1KB

MD5
39dd9cba2eb7a1cec1067529acc4d695

SHA1
f42680fa081e54203b2c92814661a974d092e138

SHA256
cc7295940d22e58e83f4a8207e27514b9a9a4e266ecc476026b90d6ff3e522f3

SHA512
80c0561487fa03941005936772f42d5b07fcf023223a47b3728921242aa84d865816819f4c3d5c8457c16bff76a3fdb38503c9b1a748b81addd9a8f0b8895f34

Download Submit
memory/952-6-0x000000000AB50000-0x000000000AC10000-memory.dmp

Filesize
768KB

Download
memory/952-2-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/952-3-0x0000000000440000-0x000000000045C000-memory.dmp

Filesize
112KB

Download
memory/952-4-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/952-5-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/952-0-0x0000000000320000-0x000000000041C000-memory.dmp

Filesize
1008KB

Download
memory/952-1-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/952-17-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-14-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-15-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2100-16-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2100-18-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 952 wrote to memory of 2100	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	powershell.exe
PID 952 wrote to memory of 2100	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	powershell.exe
PID 952 wrote to memory of 2100	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	powershell.exe
PID 952 wrote to memory of 2100	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	powershell.exe
PID 952 wrote to memory of 2324	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	schtasks.exe
PID 952 wrote to memory of 2324	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	schtasks.exe
PID 952 wrote to memory of 2324	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	schtasks.exe
PID 952 wrote to memory of 2324	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	schtasks.exe
PID 952 wrote to memory of 2600	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2600	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2600	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2600	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2952	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2952	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2952	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2952	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2464	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2464	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2464	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2464	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 1132	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 1132	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 1132	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 1132	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2616	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2616	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2616	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
PID 952 wrote to memory of 2616	952	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe	408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads