42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149

General

Target

42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
Size

791KB
MD5

64d371aa778984786fb0368d5824a841
SHA1

7044fbd5634becff21be68f42546d529a5544ff2
SHA256

42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149
SHA512

7319d9a1428c889f3ff6cfe6346a88781bcd19e137d6a1d5b67f6bbeefb27a56a1094d506b22b544c0322ffafb08322b57319ccecc16fb488a33594a65729c93
SSDEEP

12288:FwTyVhpCNtWV4Z9GthGp0V2gbEPzyGT32hAwAFFnUSf5v61pH42FuFnW5M72j1/8:FK1ZqaK5bezy031FJxRs

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

pid	process
2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

description pid process

Token: SeDebugPrivilege 2440 42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

description	pid	process
Token: SeDebugPrivilege	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
"C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
  "C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
  2⤵
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
  "C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
  "C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
  "C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
  "C:\Users\Admin\AppData\Local\Temp\42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe"
  2⤵
  PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/2440-1-0x00000000003A0000-0x000000000046C000-memory.dmp

Filesize
816KB

Download
memory/2440-2-0x0000000074E40000-0x000000007552E000-memory.dmp

Filesize
6.9MB

Download
memory/2440-3-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/2440-4-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/2440-5-0x0000000007710000-0x0000000007792000-memory.dmp

Filesize
520KB

Download
memory/2440-6-0x0000000074E40000-0x000000007552E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2440 wrote to memory of 2620	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2620	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2620	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2620	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2656	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2656	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2656	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2656	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2788	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2788	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2788	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2788	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2804	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2804	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2804	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2804	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2776	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2776	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2776	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe
PID 2440 wrote to memory of 2776	2440	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe	42a797a4f307560dc99d8f936ae0ed8a2f3811d58e7fb4bc87a0886578110149.exe

Analysis

Sharing