Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:22
Behavioral task
behavioral1
Sample
ezvirusRatV5.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
ezvirusRatV5.exe
-
Size
646KB
-
MD5
75acc1dae942fa647377c8388a0c4e3b
-
SHA1
629e124dd6a2c63db4932e7d19600ad2398ec6b5
-
SHA256
069e227af7b0c0063474eb262faeb4b3dfdf55ef400bd2684e7e249d70be5e45
-
SHA512
36a23c3fbee80a53f762fa5d8cd8b49d91480d7913c7a1104a1a5ffcfcb188d0c49a25b5ba9ff98a997ed04f6f4939c0685375e6aaa9b545bcc0b8e5b13631ca
-
SSDEEP
12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixC:5UKoN0bUxgGa/pfBHDb+y1HgZk
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ezvirusRatV5.exedescription pid process Token: SeIncreaseQuotaPrivilege 1180 ezvirusRatV5.exe Token: SeSecurityPrivilege 1180 ezvirusRatV5.exe Token: SeTakeOwnershipPrivilege 1180 ezvirusRatV5.exe Token: SeLoadDriverPrivilege 1180 ezvirusRatV5.exe Token: SeSystemProfilePrivilege 1180 ezvirusRatV5.exe Token: SeSystemtimePrivilege 1180 ezvirusRatV5.exe Token: SeProfSingleProcessPrivilege 1180 ezvirusRatV5.exe Token: SeIncBasePriorityPrivilege 1180 ezvirusRatV5.exe Token: SeCreatePagefilePrivilege 1180 ezvirusRatV5.exe Token: SeBackupPrivilege 1180 ezvirusRatV5.exe Token: SeRestorePrivilege 1180 ezvirusRatV5.exe Token: SeShutdownPrivilege 1180 ezvirusRatV5.exe Token: SeDebugPrivilege 1180 ezvirusRatV5.exe Token: SeSystemEnvironmentPrivilege 1180 ezvirusRatV5.exe Token: SeChangeNotifyPrivilege 1180 ezvirusRatV5.exe Token: SeRemoteShutdownPrivilege 1180 ezvirusRatV5.exe Token: SeUndockPrivilege 1180 ezvirusRatV5.exe Token: SeManageVolumePrivilege 1180 ezvirusRatV5.exe Token: SeImpersonatePrivilege 1180 ezvirusRatV5.exe Token: SeCreateGlobalPrivilege 1180 ezvirusRatV5.exe Token: 33 1180 ezvirusRatV5.exe Token: 34 1180 ezvirusRatV5.exe Token: 35 1180 ezvirusRatV5.exe Token: 36 1180 ezvirusRatV5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ezvirusRatV5.exepid process 1180 ezvirusRatV5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1180-133-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-134-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/1180-135-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-136-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-137-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-138-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-143-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1180-145-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB