Analysis
- max time kernel
119s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
17/01/2022, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
OFFER 12575-11-2022_Xlxs.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
OFFER 12575-11-2022_Xlxs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target OFFER 12575-11-2022_Xlxs.exe
- Size 417KB
- Sample220117-pp3byaaddq
- SHA256 e4e1e6300c86997df0002747769b29b619fe79a581bf9c5173db0761513e302a
- MD5 1389ced5b76a7a4f7667bb4c6eff69d4
- SHA1 81ee89503e21c2bc2e159c163ca256f05c94250c
- SHA512 70f1cb81bbd152639dc65df62290bf99bfbaafdcac1dc3dbd0e14b74f17d49540f9e3c3ff1aa8427c7b4ac8f678c7247598412ccd8b75c0d4f64a63d19137095
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1292 OFFER 12575-11-2022_Xlxs.exe 1292 OFFER 12575-11-2022_Xlxs.exe 1292 OFFER 12575-11-2022_Xlxs.exe 1292 OFFER 12575-11-2022_Xlxs.exe 1292 OFFER 12575-11-2022_Xlxs.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1292 OFFER 12575-11-2022_Xlxs.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1036 1292 OFFER 12575-11-2022_Xlxs.exe 27 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1540 1292 OFFER 12575-11-2022_Xlxs.exe 28 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1092 1292 OFFER 12575-11-2022_Xlxs.exe 29 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1520 1292 OFFER 12575-11-2022_Xlxs.exe 30 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31 PID 1292 wrote to memory of 1528 1292 OFFER 12575-11-2022_Xlxs.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"2⤵PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"2⤵PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"2⤵PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"2⤵PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\OFFER 12575-11-2022_Xlxs.exe"2⤵PID:1528
-