485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7

General

Target

485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
Size

163KB
MD5

e48c329a00310865d6337bc19f995b9a
SHA1

c2da3bc0632c6fa19e5658e9128a6731a1facef1
SHA256

485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7
SHA512

4d4b3a5447b77771334612afb9d3e5fc03d75c689b759bafa03160690cad3c128ce5a4e4f9f9e719d5e8f7022007e3fe18f79989ea39ffc425a60c39cba27a95
SSDEEP

3072:ZzFOw3GFvSmlpvSkNTfKr1foePOvFgUiDlQaZPsP:ivS2ZMpZ0P

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

pid	process
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

description pid process

Token: SeDebugPrivilege 2188 485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

description	pid	process
Token: SeDebugPrivilege	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe

description	pid	process	target process
PID 2188 wrote to memory of 2820	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2820	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2820	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2820	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2836	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2836	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2836	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2836	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2880	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2880	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2880	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2880	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2892	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2892	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2892	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 2892	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 1676	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 1676	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 1676	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe
PID 2188 wrote to memory of 1676	2188	485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe
"C:\Users\Admin\AppData\Local\Temp\485518fe4eb558d35ea8ea04af66331e87838e0cb0604df0ec54fab4305be4a7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x000007FEF6173000-0x000007FEF6174000-memory.dmp

Filesize
4KB

Download
memory/2188-1-0x00000000002C0000-0x00000000002F0000-memory.dmp

Filesize
192KB

Download
memory/2188-2-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2188-3-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2188-4-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing