0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573

General

Target

0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
Size

140KB
MD5

caec53ed7ab971ac19643d395f40a95e
SHA1

8459f1a2a1f3a1e1695eec0fbcb1a4baabdb86ac
SHA256

0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573
SHA512

1edb8684230a5de9d3e924d8e63f580d219ba39ee3be7a4ff9615c061e35a298e1e7be6983bd152fc68ad8f375da835da9a491023e38ed8fcbec32e7020e583e
SSDEEP

1536:9rhjRpAPFisr9l5qaKXFRcBPq49+Vfj2vrWZaRF61m2oKs7MBGzQT445j/ULtiSR:JRRpAPZrjrKncB5CoX7ex5jVrDqtd4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2240	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2680 wrote to memory of 2240	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2680 wrote to memory of 2240	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2680 wrote to memory of 2240	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	31
PID 2680 wrote to memory of 488	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2680 wrote to memory of 488	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2680 wrote to memory of 488	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2680 wrote to memory of 488	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	32
PID 2680 wrote to memory of 2260	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2680 wrote to memory of 2260	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2680 wrote to memory of 2260	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2680 wrote to memory of 2260	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	33
PID 2680 wrote to memory of 2192	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2680 wrote to memory of 2192	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2680 wrote to memory of 2192	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2680 wrote to memory of 2192	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	34
PID 2680 wrote to memory of 2744	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2680 wrote to memory of 2744	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2680 wrote to memory of 2744	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35
PID 2680 wrote to memory of 2744	2680	0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe	35

C:\Users\Admin\AppData\Local\Temp\0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
"C:\Users\Admin\AppData\Local\Temp\0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-0-0x000007FEF6393000-0x000007FEF6394000-memory.dmp

Filesize
4KB

Download
memory/2680-1-0x0000000000370000-0x0000000000398000-memory.dmp

Filesize
160KB

Download
memory/2680-2-0x000007FEF6390000-0x000007FEF6D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2680-3-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2680-4-0x000007FEF6390000-0x000007FEF6D7C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads