eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
22s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 19:10

Sharing

Target

trojan-leaks-main/Kirurg_remsaterd.exe
Size

510KB
MD5

6dd7ecf13f87fa885fede29cd4d31127
SHA1

b9e133331ebccc6e97b90205de3801502637ce86
SHA256

50042ed8c6c60b2dd79a23bb6589f83cd6ac3971fba798e6d2a580d3fea8ebf2
SHA512

4cf4897f29b6e5048506ce30988052b7a600778a6648b9ab0eb2e5cc3f25521351cd70cbe5c5aac89a77c5b1af919f715cc163e400f38cadc25de9b8b77b23dc
SSDEEP

3072:nJvLB6pF8gO5sBWHYAraok57QbHk/CD+2UAYvU1Dzn+XwDaucnuvim695e/3lG:ncvAr5eQbH0w+pv6zn+XwDarnuvB/3

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

ScreenSaver.exe

pid process

516 ScreenSaver.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
516	ScreenSaver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	672	AUDIODG.EXE
Token: 33	672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	672	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Kirurg_remsaterd.exe

description	pid	process	target process
PID 1776 wrote to memory of 516	1776	Kirurg_remsaterd.exe	ScreenSaver.exe
PID 1776 wrote to memory of 516	1776	Kirurg_remsaterd.exe	ScreenSaver.exe
PID 1776 wrote to memory of 516	1776	Kirurg_remsaterd.exe	ScreenSaver.exe
PID 1776 wrote to memory of 516	1776	Kirurg_remsaterd.exe	ScreenSaver.exe

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe
  "C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe"
  2⤵
  - Executes dropped EXE
  PID:516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:672

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe

Filesize
10KB

MD5
b5ff63f5352d3d79347f91737c5cd597

SHA1
3799699da69acf3e0c60921ca64272c84895ddd1

SHA256
0c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319

SHA512
115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4

Download Submit
memory/1776-54-0x00000000008B0000-0x0000000000936000-memory.dmp

Filesize
536KB

Download
memory/1776-55-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download
memory/1776-56-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download
memory/1776-63-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download
memory/1776-64-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download