eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
152s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09/05/2023, 19:14

Sharing

Target

trojan-leaks-main/skidded/Xazdes.exe
Size

1.9MB
MD5

62358643a1b4ebc547abba5d7bedf15a
SHA1

3d19eca4e3ae433ddc818fff65c24ff282e74b14
SHA256

44df18ae2425cd7ad00193348b986d9941039d521a7107a6861dce49ed884810
SHA512

caf43aabcd262e88be4770b966a66576b5847e84b8331e8d24a099350cf01de5214cc6e25bc526ce90213a7ef505699e56ab242a829fafd6c7650332dc336748
SSDEEP

24576:1YVU1CK2yyVGTwAvmHmAcY5tjmCEO+Ec0xMkU8JsU3AoZd0MUkOW8F:OVU1CK2ZGTwA9AjZd0MUkOW8F

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4208	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2792	2484	Xazdes.exe	66
PID 2484 wrote to memory of 2792	2484	Xazdes.exe	66

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\WINDOWS\system32\hal.dll /Q
  2⤵
  PID:2792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208

memory/2484-123-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2484-129-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2484-130-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2484-131-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2484-132-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download