2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a

General

Target

2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
Size

684KB
MD5

9d48877b73e58313d5f78e41311a1387
SHA1

c547af55bf250ab0ea29a5cbba454a94da46e6e9
SHA256

2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a
SHA512

b3d413b448aae3c3e30de5b123eef86c80ead0e90ff8116661446f41c3d7f898e702f91e1fe540d2e1d15cb59b4fc2f3bf58b0b4fd7fb658a0833f02f9b081c4
SSDEEP

12288:ONgLeFR6/Xlv312Z3GN6cXk1LHkyht9aVRB97/0jjcHjylxBP5Nlh1:lXJ312ZA6AIDtAVxYjjcHa/P5N

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

pid	process
1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

description pid process

Token: SeDebugPrivilege 1972 2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

description	pid	process
Token: SeDebugPrivilege	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
2⤵
PID:1616

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
2⤵
PID:1764

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
2⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
2⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
"C:\Users\Admin\AppData\Local\Temp\2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe"
2⤵
PID:1744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-1-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-0-0x0000000000370000-0x0000000000420000-memory.dmp

Filesize
704KB

Download
memory/1972-2-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/1972-3-0x00000000006F0000-0x0000000000710000-memory.dmp

Filesize
128KB

Download
memory/1972-4-0x00000000008C0000-0x00000000008D4000-memory.dmp

Filesize
80KB

Download
memory/1972-5-0x0000000001F20000-0x0000000001FA4000-memory.dmp

Filesize
528KB

Download
memory/1972-6-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 1972 wrote to memory of 1616	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1616	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1616	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1616	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1764	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1764	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1764	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1764	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1732	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1732	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1732	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1732	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 2188	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 2188	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 2188	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 2188	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1744	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1744	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1744	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe
PID 1972 wrote to memory of 1744	1972	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe	2229e4b5c8d5fdf7b4ab56f51dab68521234c05adaaca64b1e3e999213514a0a.exe

Analysis

Sharing