e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
Size

147KB
MD5

a06d563641bb76a56d398568ea0e9795
SHA1

dc81eb51de4d8ffbf0bbbcbdb3f3c6980d09e416
SHA256

e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54
SHA512

a1beb17ff9486409f5a1f38b63e57a5ea3e5a66fca45e832b8671c738378379d5a459a883bde9f1bd98346350e39c3a22971f373e02defa4e822e4d12d6d0913
SSDEEP

3072:n808ghSE5bkWp6aKeGn+Yembgy04MT97:8MhD5bTuevydW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2864	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	30
PID 2704 wrote to memory of 2864	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	30
PID 2704 wrote to memory of 2864	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	30
PID 2704 wrote to memory of 2864	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	30
PID 2704 wrote to memory of 2852	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	31
PID 2704 wrote to memory of 2852	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	31
PID 2704 wrote to memory of 2852	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	31
PID 2704 wrote to memory of 2852	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	31
PID 2704 wrote to memory of 2872	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	32
PID 2704 wrote to memory of 2872	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	32
PID 2704 wrote to memory of 2872	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	32
PID 2704 wrote to memory of 2872	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	32
PID 2704 wrote to memory of 2272	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	33
PID 2704 wrote to memory of 2272	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	33
PID 2704 wrote to memory of 2272	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	33
PID 2704 wrote to memory of 2272	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	33
PID 2704 wrote to memory of 2784	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	34
PID 2704 wrote to memory of 2784	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	34
PID 2704 wrote to memory of 2784	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	34
PID 2704 wrote to memory of 2784	2704	e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe	34

C:\Users\Admin\AppData\Local\Temp\e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe
"C:\Users\Admin\AppData\Local\Temp\e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2704-1-0x0000000000C10000-0x0000000000C3A000-memory.dmp

Filesize
168KB

Download
memory/2704-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-3-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/2704-4-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download