a858b2b8b4be7cb23e0a7d37a0c08489a6820cb1be5523a7a466014eb994391f | Triage

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 16:01

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$RHL25IB.exe
Size

181KB
MD5

dee74fb4b0a75386df85859443bc7cea
SHA1

1dd13451cf532dad57321840476300f7d91f2d26
SHA256

3054aceb57920cfbdf9e5f276d9037a804bcfcea1ee125da4ee2300ed335e666
SHA512

6d7b5d3c723bca9bd077e665bd254ee924e05477bebb55376fcaadf2892c4410780afabc3970f8085e373ddd7e104800018681da432b33ce8dba159463b7a292
SSDEEP

1536:B1s+W+yEReHiB0dJoVssssssswksck930mlSF:BDyTHiB0dJoVssssssswks5hSF

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

$RHL25IB.exe

description pid process

Token: SeDebugPrivilege 2780 $RHL25IB.exe

C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RHL25IB.exe
"C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RHL25IB.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-133-0x0000000000920000-0x0000000000952000-memory.dmp

Filesize
200KB

Download
memory/2780-134-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download