11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152 | Triage

Resubmissions

23-03-2023 02:24

230323-cvr2yada67 7

20-02-2023 23:48

230220-3tfwdsda52 10

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 02:24

Sharing

Report Analysis Logs

General

Target

EliStarA.exe
Size

1.7MB
MD5

6b8dcb09a6f8e836b5dcc600d11c6223
SHA1

b0a1582b9e9871064afae5cb6b1d369599506763
SHA256

11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
SHA512

feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
SSDEEP

49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-54-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral1/memory/2040-55-0x0000000000400000-0x00000000005BF000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	EliStarA.exe
Token: SeRestorePrivilege	2040	EliStarA.exe
Token: SeShutdownPrivilege	2040	EliStarA.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	EliStarA.exe
2040	EliStarA.exe

C:\Users\Admin\AppData\Local\Temp\EliStarA.exe
"C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000400000-0x00000000005BF000-memory.dmp

Filesize
1.7MB

Download
memory/2040-55-0x0000000000400000-0x00000000005BF000-memory.dmp

Filesize
1.7MB

Download