a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5

Analysis

max time kernel
150s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 20:03

Target
a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe
Size 29KB
Sample221107-ys52nshffn
SHA256 a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5
MD5 0e14b65f9be6713e8f7857d298475da9
SHA1 d007555f5c324f5e0f7e88a24ec6ca96a22419cd
SHA512 763d462343d12da9a06466644050f08c6086663b848e7db7a2daad9672d235f93206b65048b74ec55f1afa55f50e3c78cb6ab083ed8df4ac1f40ae1753eace5f
SSDEEP 768:XTVUOMgSygAVL48bDxPN7LxdGIAfoT/bmyfSA+P:GOjL40LEi3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2240	Laofan.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Laofan.exe	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe
File opened for modification	C:\Program Files\Internet Explorer\Laofan.exe	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2240	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	79
PID 2920 wrote to memory of 2240	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	79
PID 2920 wrote to memory of 2240	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	79
PID 2920 wrote to memory of 728	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	80
PID 2920 wrote to memory of 728	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	80
PID 2920 wrote to memory of 728	2920	a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe	80

C:\Users\Admin\AppData\Local\Temp\a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe
"C:\Users\Admin\AppData\Local\Temp\a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files\Internet Explorer\Laofan.exe
  "C:\Program Files\Internet Explorer\Laofan.exe"
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\A23B58~1.EXE > nul
  2⤵
  PID:728

Laofan.exe

Path C:\Program Files\Internet Explorer\Laofan.exe
Size 29KB
SHA256 a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5
MD5 0e14b65f9be6713e8f7857d298475da9
SHA1 d007555f5c324f5e0f7e88a24ec6ca96a22419cd
SHA512 763d462343d12da9a06466644050f08c6086663b848e7db7a2daad9672d235f93206b65048b74ec55f1afa55f50e3c78cb6ab083ed8df4ac1f40ae1753eace5f
SSDEEP 768:XTVUOMgSygAVL48bDxPN7LxdGIAfoT/bmyfSA+P:GOjL40LEi3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laofan.exe

Path C:\Program Files\Internet Explorer\Laofan.exe
Size 29KB
SHA256 a23b58b449ef923cdd4ed078043b6052c4846ed01a7a7246aabda840a7975eb5
MD5 0e14b65f9be6713e8f7857d298475da9
SHA1 d007555f5c324f5e0f7e88a24ec6ca96a22419cd
SHA512 763d462343d12da9a06466644050f08c6086663b848e7db7a2daad9672d235f93206b65048b74ec55f1afa55f50e3c78cb6ab083ed8df4ac1f40ae1753eace5f
SSDEEP 768:XTVUOMgSygAVL48bDxPN7LxdGIAfoT/bmyfSA+P:GOjL40LEi3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2920-132-0x0000000000400000-0x0000000000409B3C-memory.dmp

Download