22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f

General

Target

22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
Size

654KB
MD5

cd36e226b757c597bf07e146ab38fd5f
SHA1

52e4dcfdadea209d850ca5905d1ae23cdd04e7b6
SHA256

22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f
SHA512

76ad698e0bf3d2b96dd6a26975ae61340eff9397b4a8945ef7992a278272ed1ed3c80726c9056a5de6e269482cbdbc660735993ecf7e8842689591c1e6269a6b
SSDEEP

12288:ON4zi8LkpEaTmQjBs6cxOXWWGUBu06VC8kG3tEKMV8wMxdsp6bylj4:ON42jEtQj1ckWWGU09VC8r9+V8Px+pX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

pid	process
2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

description pid process

Token: SeDebugPrivilege 2044 22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

description	pid	process
Token: SeDebugPrivilege	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
"C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
  "C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
  "C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
  "C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
  "C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
  "C:\Users\Admin\AppData\Local\Temp\22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe"
  2⤵
  PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/2044-1-0x00000000003D0000-0x000000000047A000-memory.dmp

Filesize
680KB

Download
memory/2044-2-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-3-0x00000000006F0000-0x000000000070A000-memory.dmp

Filesize
104KB

Download
memory/2044-4-0x0000000000480000-0x0000000000490000-memory.dmp

Filesize
64KB

Download
memory/2044-5-0x0000000005210000-0x0000000005292000-memory.dmp

Filesize
520KB

Download
memory/2044-6-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2044 wrote to memory of 2688	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2688	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2688	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2688	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2676	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2676	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2676	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2676	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2712	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2712	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2712	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2712	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2672	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2672	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2672	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2672	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2556	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2556	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2556	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe
PID 2044 wrote to memory of 2556	2044	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe	22e4ac0f2435dc4e88ccea399f05373101864372ef28d0674e4ebd52a9db8b7f.exe

Analysis

Sharing