Analysis
-
max time kernel
117s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09-05-2023 19:16
General
-
Target
trojan-leaks-main/Glodrix.exe
-
Size
416KB
-
MD5
766e0dceb95f26a79300e786669fd4c3
-
SHA1
56bd2f5f37d012059e44185a4405332891b8efb6
-
SHA256
a2d0fcecb809ae416d8d532f7eb58505977aeb00c66f0d51b70025946bc599b3
-
SHA512
9cc4ab1466de58815ea48350f5e31135d9acfce87ba58863eb5632b6b56b5b512cae5b9a512b0400f45e982ad711a3c637bd79a3fe721df9ab0e659b8dd2a204
-
SSDEEP
6144:23nEFPjLXbeQHD0wyqwYxKk+CKEEwL1fFx++/BsPZ:EnEFPjLtHvyqwYg3Tsj6
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Glodrix.exe"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Glodrix.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x4bc1⤵
- Suspicious use of AdjustPrivilegeToken