5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5

Resubmissions

05-09-2023 01:34

230905-by5lrsch46 10

Analysis

max time kernel
35s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
Size

554KB
MD5

105814bac2dfd18013fcd6110e8da3fa
SHA1

7294336871bab0cd1391bae4ece6f2ce49770d2c
SHA256

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb
SHA512

371750239a46c19da755e4578975e4b8daee749a746ec8ae0942969ef43592dcb55d12ef7dc18de6a4ef580ce3bc0c2765ff7634638a68d39287ec2ddaeeb3e9
SSDEEP

12288:Ykd04ufFuI4bf7zM2wsbTe8hUg4agLinoh/YZ0bwYIELpp1:/d+fr49wOTe76gLoBXRELpL

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

pid	process
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

description pid process

Token: SeDebugPrivilege 2432 e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

description	pid	process
Token: SeDebugPrivilege	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
2⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
2⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
2⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
2⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
"C:\Users\Admin\AppData\Local\Temp\e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe"
2⤵
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000000380000-0x0000000000410000-memory.dmp

Filesize
576KB

Download
memory/2432-2-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-3-0x00000000002C0000-0x00000000002D4000-memory.dmp

Filesize
80KB

Download
memory/2432-4-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download
memory/2432-5-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-6-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/2432-7-0x0000000004F20000-0x0000000004F8E000-memory.dmp

Filesize
440KB

Download
memory/2432-8-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2432 wrote to memory of 2696	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2696	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2696	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2696	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2844	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2844	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2844	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2844	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2860	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2860	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2860	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2860	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2232	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2232	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2232	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2232	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2796	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2796	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2796	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe
PID 2432 wrote to memory of 2796	2432	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe	e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe