eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
136s
max time network
169s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/cleansaturn.exe
Size

3.8MB
MD5

0f597e254135a708137a52470943316c
SHA1

86240613459d76fff43d9995f73c97f75ee680c1
SHA256

8763150d50e887141961f8c027acf92d5698e8e925cc5e76515d6d8fe330cb26
SHA512

408fe3bd85921cdf5576caa55e28213849c07340817c33605a68fa3da72ae512c0ac710b3a3cb4cbff44c5f64cfb0715034604a5de7bf9c5b6adce4919a2f6eb
SSDEEP

24576:QZ+4JwLcEVrX0VlkxDXMluVGOVCuaYE2IrUOUOqpUKKskz22ETGKJ8QeKzG+9eX:QZoLpXVxgKVCurqZJqhKskzLgGKp5e

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

cleansaturn.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 3424 cleansaturn.exe
Token: 33 4300 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4300 AUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	3424	cleansaturn.exe
Token: 33	4300	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4300	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\cleansaturn.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\cleansaturn.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300

memory/3424-121-0x0000000000870000-0x0000000000C5B000-memory.dmp

Filesize
3.9MB

Download
memory/3424-124-0x0000000000870000-0x0000000000C5B000-memory.dmp

Filesize
3.9MB

Download