9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe
Size

1.4MB
MD5

ee6a8f042f195320db7336a804c089dc
SHA1

cd4a80b88d6fc682e4a0843b32fd5f563cab5961
SHA256

9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1
SHA512

c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065
SSDEEP

24576:BViMJoH/8uIvJZXoUQ/MQ/amGHPP7cTFtSUMY/U8hd5o1o1Dqqef6e11ie:VJiJOoUQ/MIGHPP7cTCUMYr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4536	YjLu0asVxyAf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	YjLu0asVxyAf.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4536	4780	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	82
PID 4780 wrote to memory of 4536	4780	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	82

C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe
"C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\YjLu0asVxyAf.exe
  C:\Users\Admin\YjLu0asVxyAf.exe start "C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe" \\.\pipe\Winsock2\Slader-YjLu0asVxy
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\YjLu0asVxyAf.exe

Filesize
1.4MB

MD5
ee6a8f042f195320db7336a804c089dc

SHA1
cd4a80b88d6fc682e4a0843b32fd5f563cab5961

SHA256
9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

SHA512
c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065

Download Submit
C:\Users\Admin\YjLu0asVxyAf.exe

Filesize
1.4MB

MD5
ee6a8f042f195320db7336a804c089dc

SHA1
cd4a80b88d6fc682e4a0843b32fd5f563cab5961

SHA256
9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

SHA512
c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065

Download Submit
memory/4536-138-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/4536-140-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/4536-142-0x00007FF84FD90000-0x00007FF850851000-memory.dmp

Filesize
10.8MB

Download
memory/4536-144-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/4536-143-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/4536-146-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/4536-147-0x00007FF84FD90000-0x00007FF850851000-memory.dmp

Filesize
10.8MB

Download
memory/4536-148-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/4780-137-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads