781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5

General

Target

781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
Size

774KB
MD5

8b7b19184d4eaa008d1cbba2bfece478
SHA1

6b9eb0677d179ccdbb102c9afd7301861f704dfc
SHA256

781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5
SHA512

c4a18213049ceb04d32f102bde262a6e05ea231e3aeca4a0f343e292316921c29f7cafbe5d61fb2ae87f0ecbd68657f142c6333754b5d857ccffefd90df0551f
SSDEEP

24576:lWtb3BEDCnB93LtxDXkJORp71RFE0nu3Tv:IZBEDUBhLth0Q/1RFE/3Tv

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

pid	process
1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

description pid process

Token: SeDebugPrivilege 1636 781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

description	pid	process
Token: SeDebugPrivilege	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
2⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
2⤵
PID:2776

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
2⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
2⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
"C:\Users\Admin\AppData\Local\Temp\781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe"
2⤵
PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/1636-1-0x0000000000350000-0x0000000000414000-memory.dmp

Filesize
784KB

Download
memory/1636-2-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1636-3-0x0000000001EB0000-0x0000000001ED2000-memory.dmp

Filesize
136KB

Download
memory/1636-4-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/1636-5-0x0000000001E10000-0x0000000001E20000-memory.dmp

Filesize
64KB

Download
memory/1636-6-0x0000000005B00000-0x0000000005B84000-memory.dmp

Filesize
528KB

Download
memory/1636-7-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/1636-8-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1636-9-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 1636 wrote to memory of 2292	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2292	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2292	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2292	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2776	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2776	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2776	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2776	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2572	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2572	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2572	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2572	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2492	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2492	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2492	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2492	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2808	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2808	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2808	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe
PID 1636 wrote to memory of 2808	1636	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe	781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5.exe

Analysis

Sharing