Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
odeme.xl200.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
odeme.xl200.exe
-
Size
515KB
-
MD5
e57f53e16f57d9d28cb7c00e3e0c51f3
-
SHA1
abcd5179dd64504a12d4a854cde93826882e9b43
-
SHA256
06d8b2fecf78c785a15181b34a74859e87fcec54dd231b13ea9fe79983ba9a95
-
SHA512
f36b8425f5231d7e8bcc07617ab17bde7db27abcfb49a69e5238b1070b847d0f1acd70fcfd7b793ed80f6751481576e3c33ab3b1e5fadb387634e267b42b79b0
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
odeme.xl200.exepid process 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe 1760 odeme.xl200.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
odeme.xl200.exedescription pid process Token: SeDebugPrivilege 1760 odeme.xl200.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
odeme.xl200.exedescription pid process target process PID 1760 wrote to memory of 1936 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1936 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1936 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1936 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 652 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 652 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 652 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 652 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 736 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 736 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 736 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 736 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1004 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1004 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1004 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1004 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2008 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2008 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2008 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2008 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1348 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1348 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1348 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1348 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1208 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1208 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1208 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1208 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1704 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1704 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1704 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 1704 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2040 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2040 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2040 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 2040 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 840 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 840 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 840 1760 odeme.xl200.exe odeme.xl200.exe PID 1760 wrote to memory of 840 1760 odeme.xl200.exe odeme.xl200.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe"C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\odeme.xl200.exeC:\Users\Admin\AppData\Local\Temp\odeme.xl200.exe2⤵