Analysis
-
max time kernel
112s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe
Resource
win10v2004-20220901-en
General
-
Target
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe
-
Size
27KB
-
MD5
54c35b969220cbaf3aeb27ecd1e9b87b
-
SHA1
0436f2485792cbb64e8ee2249d217aeeaabc556c
-
SHA256
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe
-
SHA512
e1285c78d7824660b74d888e3b2662d1d0b81f88bdf6804ccf088b26cd451e507e31dc0fc8187934c58f8d068bc9e3f3c35fb1f3a49d6a1312d18dfd48928aa3
-
SSDEEP
384:smOyMLjKM6HUDxw7CA8l9ZoA7k+w9x5hmshR0IkR46nzocxn8mIRRtssIeoCACor:ZUjKTCl9Rv+x6nz+Xj1xA7egGe
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
Processes:
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exedescription ioc process File created C:\Program Files (x86)\Bifrost\server.exe 3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe File opened for modification C:\Program Files (x86)\Bifrost\server.exe 3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exedescription pid process Token: SeDebugPrivilege 4284 3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe Token: SeDebugPrivilege 4284 3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe"C:\Users\Admin\AppData\Local\Temp\3fd4f06130defcd1a75dab39a42d09d1338c8b29181b1c5cb3efe642f25bcbfe.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4284