a858b2b8b4be7cb23e0a7d37a0c08489a6820cb1be5523a7a466014eb994391f | Triage

Analysis

max time kernel
352s
max time network
470s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 16:01

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$RHL25IB.exe
Size

181KB
MD5

dee74fb4b0a75386df85859443bc7cea
SHA1

1dd13451cf532dad57321840476300f7d91f2d26
SHA256

3054aceb57920cfbdf9e5f276d9037a804bcfcea1ee125da4ee2300ed335e666
SHA512

6d7b5d3c723bca9bd077e665bd254ee924e05477bebb55376fcaadf2892c4410780afabc3970f8085e373ddd7e104800018681da432b33ce8dba159463b7a292
SSDEEP

1536:B1s+W+yEReHiB0dJoVssssssswksck930mlSF:BDyTHiB0dJoVssssssswks5hSF

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

$RHL25IB.exe

description pid process

Token: SeDebugPrivilege 1172 $RHL25IB.exe

C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RHL25IB.exe
"C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RHL25IB.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-54-0x0000000000120000-0x0000000000152000-memory.dmp

Filesize
200KB

Download
memory/1172-55-0x0000000004030000-0x0000000004070000-memory.dmp

Filesize
256KB

Download
memory/1172-56-0x0000000004030000-0x0000000004070000-memory.dmp

Filesize
256KB

Download