a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b

General

Target
a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
Size 872KB
Sample240618-wryvvstdqd
SHA256 a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b
MD5 0534a79a51432d3678e88ea60e41e49b
SHA1 c97a8d7efb5f990d1b4305d9c2055bdd8c9971a2
SHA512 639149a000727a7c08b40a85bd2424555a1244e6ff7a73a920c6efc4030ecdd1fb91540b0068eded567bef4483f6c49ce6b84d0359cc27ab572832f830906742
SSDEEP 24576:zBAyC5l2GSbFaL6NLpZ51lZzLsb7rcO8kN:K3j2nFaLsT51jMbH7N
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2360	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	28
PID 1708 wrote to memory of 2360	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	28
PID 1708 wrote to memory of 2360	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	28
PID 1708 wrote to memory of 2360	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	28
PID 1708 wrote to memory of 2616	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	29
PID 1708 wrote to memory of 2616	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	29
PID 1708 wrote to memory of 2616	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	29
PID 1708 wrote to memory of 2616	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	29
PID 1708 wrote to memory of 2684	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	30
PID 1708 wrote to memory of 2684	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	30
PID 1708 wrote to memory of 2684	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	30
PID 1708 wrote to memory of 2684	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	30
PID 1708 wrote to memory of 2700	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	31
PID 1708 wrote to memory of 2700	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	31
PID 1708 wrote to memory of 2700	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	31
PID 1708 wrote to memory of 2700	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	31
PID 1708 wrote to memory of 2704	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	32
PID 1708 wrote to memory of 2704	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	32
PID 1708 wrote to memory of 2704	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	32
PID 1708 wrote to memory of 2704	1708	a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe	32

C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
"C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
  2⤵
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4bb6414cb7d0a37ed6b06994e516b00793e32eaceba2af7a3e638a4832cc07b.exe"
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x000000007476E000-0x000000007476F000-memory.dmp

Download

memory/1708-1-0x00000000003B0000-0x0000000000490000-memory.dmp

Download

memory/1708-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Download

memory/1708-3-0x0000000000660000-0x000000000067A000-memory.dmp

Download

memory/1708-4-0x00000000006C0000-0x00000000006D0000-memory.dmp

Download

memory/1708-5-0x0000000005C80000-0x0000000005D02000-memory.dmp

Download

memory/1708-6-0x0000000074760000-0x0000000074E4E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads