Overview
overview
7Static
static
7trojan-lea...za.exe
windows10-1703-x64
7trojan-lea...za.exe
windows7-x64
7trojan-lea...za.exe
windows10-2004-x64
7trojan-lea...is.exe
windows10-1703-x64
3trojan-lea...is.exe
windows7-x64
3trojan-lea...is.exe
windows10-2004-x64
3trojan-lea...es.exe
windows10-1703-x64
1trojan-lea...es.exe
windows7-x64
1trojan-lea...es.exe
windows10-2004-x64
1trojan-lea...readme
windows10-1703-x64
1trojan-lea...readme
windows7-x64
1trojan-lea...readme
windows10-2004-x64
1trojan-lea...oc.exe
windows10-1703-x64
6trojan-lea...oc.exe
windows7-x64
6trojan-lea...oc.exe
windows10-2004-x64
6trojan-lea...in.zip
windows10-1703-x64
1trojan-lea...in.zip
windows7-x64
1trojan-lea...in.zip
windows10-2004-x64
trojan-lea...23).7z
windows10-1703-x64
3trojan-lea...23).7z
windows7-x64
3trojan-lea...23).7z
windows10-2004-x64
trojan-lea...DI.exe
windows10-1703-x64
1trojan-lea...DI.exe
windows7-x64
1trojan-lea...DI.exe
windows10-2004-x64
1trojan-lea...n).exe
windows10-1703-x64
7trojan-lea...n).exe
windows7-x64
7trojan-lea...n).exe
windows10-2004-x64
7trojan-lea...n).exe
windows10-1703-x64
7trojan-lea...n).exe
windows7-x64
7trojan-lea...n).exe
windows10-2004-x64
Resubmissions
09-05-2023 19:22
230509-x3fn4adg58 1009-05-2023 19:14
230509-xxsrgaff7x 1009-05-2023 19:14
230509-xxr5yadg42 709-05-2023 19:14
230509-xxrt6sff7w 809-05-2023 19:14
230509-xxrjeaff7v 809-05-2023 19:14
230509-xxqxwadg39 709-05-2023 19:14
230509-xxql4sff7t 1009-05-2023 19:14
230509-xxqbcadg38 709-05-2023 19:10
230509-xvl6xadf64 10Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09-05-2023 19:14
Behavioral task
behavioral1
Sample
trojan-leaks-main/skidded/Quakeganza.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
trojan-leaks-main/skidded/Quakeganza.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
trojan-leaks-main/skidded/Quakeganza.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
trojan-leaks-main/skidded/Unis.exe
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
trojan-leaks-main/skidded/Unis.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
trojan-leaks-main/skidded/Unis.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
trojan-leaks-main/skidded/Xazdes.exe
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
trojan-leaks-main/skidded/Xazdes.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
trojan-leaks-main/skidded/Xazdes.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
trojan-leaks-main/skidded/readme
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
trojan-leaks-main/skidded/readme
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
trojan-leaks-main/skidded/readme
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
trojan-leaks-main/skidded/shacoc.exe
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
trojan-leaks-main/skidded/shacoc.exe
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
trojan-leaks-main/skidded/shacoc.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
trojan-leaks-main/skidded/tin.zip
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
trojan-leaks-main/skidded/tin.zip
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
trojan-leaks-main/skidded/tin.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
trojan-leaks-main/sphenoidale (pass 123).7z
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
trojan-leaks-main/sphenoidale (pass 123).7z
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
trojan-leaks-main/sphenoidale (pass 123).7z
Resource
win10v2004-20230221-en
Behavioral task
behavioral22
Sample
trojan-leaks-main/sphenoidale GDI.exe
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
trojan-leaks-main/sphenoidale GDI.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
trojan-leaks-main/sphenoidale GDI.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
trojan-leaks-main/ő (en).exe
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
trojan-leaks-main/ő (en).exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
trojan-leaks-main/ő (en).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
trojan-leaks-main/ő (en).exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
trojan-leaks-main/ő (en).exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
trojan-leaks-main/ő (en).exe
Resource
win10v2004-20230220-en
General
-
Target
trojan-leaks-main/skidded/Xazdes.exe
-
Size
1.9MB
-
MD5
62358643a1b4ebc547abba5d7bedf15a
-
SHA1
3d19eca4e3ae433ddc818fff65c24ff282e74b14
-
SHA256
44df18ae2425cd7ad00193348b986d9941039d521a7107a6861dce49ed884810
-
SHA512
caf43aabcd262e88be4770b966a66576b5847e84b8331e8d24a099350cf01de5214cc6e25bc526ce90213a7ef505699e56ab242a829fafd6c7650332dc336748
-
SSDEEP
24576:1YVU1CK2yyVGTwAvmHmAcY5tjmCEO+Ec0xMkU8JsU3AoZd0MUkOW8F:OVU1CK2ZGTwA9AjZd0MUkOW8F
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4208 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4208 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Xazdes.exedescription pid process target process PID 2484 wrote to memory of 2792 2484 Xazdes.exe cmd.exe PID 2484 wrote to memory of 2792 2484 Xazdes.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del C:\WINDOWS\system32\hal.dll /Q2⤵PID:2792
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2484-123-0x0000000000400000-0x0000000000503000-memory.dmpFilesize
1.0MB
-
memory/2484-129-0x0000000000400000-0x0000000000503000-memory.dmpFilesize
1.0MB
-
memory/2484-130-0x0000000000400000-0x0000000000503000-memory.dmpFilesize
1.0MB
-
memory/2484-131-0x0000000000400000-0x0000000000503000-memory.dmpFilesize
1.0MB
-
memory/2484-132-0x0000000000400000-0x0000000000503000-memory.dmpFilesize
1.0MB