Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 14:58
Static task
static1
Behavioral task
behavioral1
Sample
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
Resource
win10v2004-20230703-en
General
-
Target
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
-
Size
232KB
-
MD5
c16c222ea59c1c5645d4071a0615217f
-
SHA1
83e94c1bec93dce47a144bfdfb63020a1291980e
-
SHA256
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863
-
SHA512
4de85e3c0b1476876596caf3e5be192755472bf09ea00d6d18ca8e1aa74ba4eb46c6080a25c7568b8cab208fb18f1ce6b8ee300005987d3ffc2ff7fbb739434b
-
SSDEEP
6144:77kRWMAXbegF97VqAKSFDv5wEpBNURJMHvNVdAwWNY+:74f6bew7Q4DR//NU8PNVdCN
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2848-136-0x000001BE12F60000-0x000001BE12F97000-memory.dmp upx behavioral2/memory/2848-138-0x000001BE12F60000-0x000001BE12F97000-memory.dmp upx behavioral2/memory/2848-148-0x000001BE12F60000-0x000001BE12F97000-memory.dmp upx behavioral2/memory/2848-150-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral2/memory/2848-153-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral2/memory/2848-154-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral2/memory/2848-155-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral2/memory/2848-156-0x000001BE12F60000-0x000001BE12F97000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 2848 e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe Token: SeSecurityPrivilege 2848 e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe