3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8

General

Target

3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
Size

503KB
MD5

51f1fee73b718b767fce1ef9c33b1faa
SHA1

25631c3c8a52166dfa46db1d57f4acca4a38546f
SHA256

3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8
SHA512

1e4c45e7aa2951c0d4258b909ca062ed16148b4fce5a14bf5277fd1c5781ccbfceec333efdc236ba5cc9ec12082913199b524b2df67292b1abe3478bbafe8b8d
SSDEEP

6144:fij2hYUvFIsP3Qm5cedrtLioM33dGON9ANms1XqZMr+hkEZVOdT+B0FlDwuJk6UD:rFIsPAedrR9acg9mq2CvAdK/lIb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2640	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	28
PID 1192 wrote to memory of 2640	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	28
PID 1192 wrote to memory of 2640	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	28
PID 1192 wrote to memory of 2640	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	28
PID 1192 wrote to memory of 2360	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	29
PID 1192 wrote to memory of 2360	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	29
PID 1192 wrote to memory of 2360	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	29
PID 1192 wrote to memory of 2360	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	29
PID 1192 wrote to memory of 2688	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	30
PID 1192 wrote to memory of 2688	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	30
PID 1192 wrote to memory of 2688	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	30
PID 1192 wrote to memory of 2688	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	30
PID 1192 wrote to memory of 2704	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	31
PID 1192 wrote to memory of 2704	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	31
PID 1192 wrote to memory of 2704	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	31
PID 1192 wrote to memory of 2704	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	31
PID 1192 wrote to memory of 2700	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	32
PID 1192 wrote to memory of 2700	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	32
PID 1192 wrote to memory of 2700	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	32
PID 1192 wrote to memory of 2700	1192	3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe	32

C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
"C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
  2⤵
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8.exe"
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-0-0x000000007424E000-0x000000007424F000-memory.dmp

Filesize
4KB

Download
memory/1192-1-0x00000000001F0000-0x0000000000274000-memory.dmp

Filesize
528KB

Download
memory/1192-2-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/1192-3-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/1192-4-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/1192-5-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/1192-6-0x0000000001F30000-0x0000000001F92000-memory.dmp

Filesize
392KB

Download
memory/1192-7-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads