11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152 | Triage

Resubmissions

23-03-2023 02:24

230323-cvr2yada67 7

20-02-2023 23:48

230220-3tfwdsda52 10

Analysis

max time kernel
40s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 02:24

Sharing

Report Analysis Logs

General

Target

EliStarA.exe
Size

1.7MB
MD5

6b8dcb09a6f8e836b5dcc600d11c6223
SHA1

b0a1582b9e9871064afae5cb6b1d369599506763
SHA256

11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
SHA512

feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
SSDEEP

49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4040-133-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4040-134-0x0000000000400000-0x00000000005BF000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

EliStarA.exe

description pid process

Token: SeDebugPrivilege 4040 EliStarA.exe
Token: SeRestorePrivilege 4040 EliStarA.exe
Token: SeShutdownPrivilege 4040 EliStarA.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

EliStarA.exe

pid process

4040 EliStarA.exe
4040 EliStarA.exe

C:\Users\Admin\AppData\Local\Temp\EliStarA.exe
"C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4040-133-0x0000000000400000-0x00000000005BF000-memory.dmp

Filesize
1.7MB

Download
memory/4040-134-0x0000000000400000-0x00000000005BF000-memory.dmp

Filesize
1.7MB

Download