0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573

General

Target

0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
Size

140KB
MD5

caec53ed7ab971ac19643d395f40a95e
SHA1

8459f1a2a1f3a1e1695eec0fbcb1a4baabdb86ac
SHA256

0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573
SHA512

1edb8684230a5de9d3e924d8e63f580d219ba39ee3be7a4ff9615c061e35a298e1e7be6983bd152fc68ad8f375da835da9a491023e38ed8fcbec32e7020e583e
SSDEEP

1536:9rhjRpAPFisr9l5qaKXFRcBPq49+Vfj2vrWZaRF61m2oKs7MBGzQT445j/ULtiSR:JRRpAPZrjrKncB5CoX7ex5jVrDqtd4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1936	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2168 wrote to memory of 1936	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2168 wrote to memory of 1936	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2168 wrote to memory of 1936	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2168 wrote to memory of 2292	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2168 wrote to memory of 2292	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2168 wrote to memory of 2292	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2168 wrote to memory of 2292	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2168 wrote to memory of 2684	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2168 wrote to memory of 2684	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2168 wrote to memory of 2684	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2168 wrote to memory of 2684	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2168 wrote to memory of 2672	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2168 wrote to memory of 2672	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2168 wrote to memory of 2672	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2168 wrote to memory of 2672	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2168 wrote to memory of 2648	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2168 wrote to memory of 2648	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2168 wrote to memory of 2648	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2168 wrote to memory of 2648	2168	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35

C:\Users\Admin\AppData\Local\Temp\0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
"C:\Users\Admin\AppData\Local\Temp\0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000001210000-0x0000000001238000-memory.dmp

Filesize
160KB

Download
memory/2168-2-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-3-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2168-4-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads