649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a

Submit
Reports

Overview

overview

Static

static

233f95c87f...31.exe

windows7-x64

233f95c87f...31.exe

windows10-2004-x64

2d8ea1230d...aa.exe

windows7-x64

2d8ea1230d...aa.exe

windows10-2004-x64

34dba85bb2...1a.exe

windows7-x64

34dba85bb2...1a.exe

windows10-2004-x64

463d0b0903...ea.exe

windows7-x64

463d0b0903...ea.exe

windows10-2004-x64

4bcf45bde8...39.exe

windows7-x64

4bcf45bde8...39.exe

windows10-2004-x64

5292b8004f...ce.exe

windows7-x64

5292b8004f...ce.exe

windows10-2004-x64

6babc5b52d...53.dll

windows7-x64

6babc5b52d...53.dll

windows10-2004-x64

85b73b7b3c...45.exe

windows7-x64

85b73b7b3c...45.exe

windows10-2004-x64

8eb41b097a...ff.exe

windows7-x64

8eb41b097a...ff.exe

windows10-2004-x64

932380926b...ef.exe

windows7-x64

932380926b...ef.exe

windows10-2004-x64

9d8729b9ca...de.exe

windows7-x64

9d8729b9ca...de.exe

windows10-2004-x64

9e147a3bb2...53.dll

windows7-x64

9e147a3bb2...53.dll

windows10-2004-x64

bccfdc8e1a...96.exe

windows7-x64

bccfdc8e1a...96.exe

windows10-2004-x64

bf5a9bb619...d7.exe

windows7-x64

bf5a9bb619...d7.exe

windows10-2004-x64

d0017384df...0a.exe

windows7-x64

d0017384df...0a.exe

windows10-2004-x64

d72aa8fe30...89.exe

windows7-x64

d72aa8fe30...89.exe

windows10-2004-x64

Resubmissions

15-11-2024 18:05

241115-wpjcdsxrdy 10

11-11-2024 21:40

241111-1h6xbsxcql 10

03-12-2022 17:54

221203-wg4ncscc33 10

Analysis

max time kernel
249s
max time network
309s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Static task

static1

vmprotect

1 signatures

Behavioral task

behavioral1

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win7-20220901-en

vmprotect

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win10v2004-20221111-en

vmprotect

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win7-20220812-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 stealer

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win10v2004-20220812-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 stealer

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Resource

win7-20220812-en

persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Resource

win10v2004-20220812-en

persistence

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win7-20220901-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win7-20220812-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win7-20220901-en

redline nam6.1 infostealer spyware

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral12

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win10v2004-20220812-en

redline nam6.1 infostealer spyware

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral13

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win7-20220812-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win7-20220812-en

privateloader evasion loader main spyware stealer trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral16

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win10v2004-20220901-en

privateloader evasion loader main spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral17

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win7-20221111-en

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral18

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral19

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win7-20221111-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win7-20220901-en

evasion trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral22

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral23

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win7-20221111-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win7-20221111-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win7-20220812-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win7-20220812-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win10v2004-20220901-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win7-20221111-en

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral32

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe
Size

44KB
MD5

caef853daea33a8898555fee1d45e093
SHA1

f32005ded199e821ef77d501f8368a9dcc89c20c
SHA256

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7
SHA512

b9e37d92c74d9b0677c1c7f8ca2e68fbda5d04b2ca206f6b5401d32073c798a827c6cf449ccecf9c6b58ed15b3ca18b4ba0b5c53c0566ca194affc5eb411a92b
SSDEEP

768:8jYeM17XpwE3sKfkCbJokUP/W1CqpBoa8PP:feW71D6xP/WIquPP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

description pid process

Token: SeDebugPrivilege 4552 bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

description	pid	process
Token: SeDebugPrivilege	4552	bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe
"C:\Users\Admin\AppData\Local\Temp\bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-132-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/4552-133-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/4552-134-0x0000000001650000-0x00000000016E2000-memory.dmp

Filesize
584KB

Download
memory/4552-135-0x0000000001740000-0x000000000174A000-memory.dmp

Filesize
40KB

Download