eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
306s
max time network
420s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/skidded/Xazdes.exe
Size

1.9MB
MD5

62358643a1b4ebc547abba5d7bedf15a
SHA1

3d19eca4e3ae433ddc818fff65c24ff282e74b14
SHA256

44df18ae2425cd7ad00193348b986d9941039d521a7107a6861dce49ed884810
SHA512

caf43aabcd262e88be4770b966a66576b5847e84b8331e8d24a099350cf01de5214cc6e25bc526ce90213a7ef505699e56ab242a829fafd6c7650332dc336748
SSDEEP

24576:1YVU1CK2yyVGTwAvmHmAcY5tjmCEO+Ec0xMkU8JsU3AoZd0MUkOW8F:OVU1CK2ZGTwA9AjZd0MUkOW8F

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1688	AUDIODG.EXE
Token: 33	1688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1688	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Xazdes.exe

description	pid	process	target process
PID 804 wrote to memory of 1668	804	Xazdes.exe	cmd.exe
PID 804 wrote to memory of 1668	804	Xazdes.exe	cmd.exe
PID 804 wrote to memory of 1668	804	Xazdes.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Xazdes.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\WINDOWS\system32\hal.dll /Q
  2⤵
  PID:1668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x214
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

memory/804-54-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/804-60-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/804-61-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/804-62-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/804-63-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download