Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
15/04/2023, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
x9Kg1ok5Gtpc.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
General
- Target x9Kg1ok5Gtpc.exe
- Size 26KB
- Sample230415-cht1rscf97
- SHA256 7d4b3075e5d378b4731f4d0ece607bf03492efac7eb6439d5af6d7716dc26da7
- MD5 e2fef867cbf2a9ef4daf295e53421ae4
- SHA1 d0d74814416e7c71042361a1fd053f5ee6b34a93
- SHA512 7a45ff2031dabaa790e4bddf9b452585eacdf9ff053f86e5ebdec1e648a49f2d29eb6e895a88e12b3c0fc5966e770eefe62f1930466c445503bf66cf9412d66e
- SSDEEP 384:SLd6haZIVi/dMkt1cpDkjetHzCYe/4Y2OzRLTm3yilqr63sb+tVvGf:Mw0IVi/dMc1uT5e/4sEHVvGf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe Token: SeIncBasePriorityPrivilege 4280 x9Kg1ok5Gtpc.exe Token: 33 4280 x9Kg1ok5Gtpc.exe