a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080

General

Target

a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
Size

108KB
MD5

996817a2a2c9afe0a459bd0cc9a68d74
SHA1

23770e473ea88638874473b631602f437a799760
SHA256

a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080
SHA512

24a7cdcaf49b9d565da4df977b084f0b94c82f33f1dd80621e649040baa85565aef9cb147036674ec57f3586e3038cdafacbdb6724e61a651c168359deda1df1
SSDEEP

3072:6dS3TaTBi6I/TPDe3R2/8fDvDySHzDed:65i7TSB2abGSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

pid	process
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

description pid process

Token: SeDebugPrivilege 2384 a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

description	pid	process
Token: SeDebugPrivilege	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe

description	pid	process	target process
PID 2384 wrote to memory of 2528	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2528	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2528	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2528	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1420	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1420	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1420	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1420	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1552	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1552	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1552	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1552	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2572	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2572	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2572	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 2572	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1620	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1620	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1620	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe
PID 2384 wrote to memory of 1620	2384	a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe
"C:\Users\Admin\AppData\Local\Temp\a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x000007FEF5D63000-0x000007FEF5D64000-memory.dmp

Filesize
4KB

Download
memory/2384-1-0x0000000000EE0000-0x0000000000F00000-memory.dmp

Filesize
128KB

Download
memory/2384-2-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-3-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/2384-4-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing