Analysis
-
max time kernel
156s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
PekzLOG.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PekzLOG.exe
Resource
win10v2004-20230915-en
General
-
Target
PekzLOG.exe
-
Size
535KB
-
MD5
5504cead28af15658cd2c26c358759e6
-
SHA1
5d444a6f79f1ce9069c4a940687ced21b96e616c
-
SHA256
f2cea2ace90fadcf5ee82ed9ebc1f7dc577a3b1fbce75b2831c1b170879d5494
-
SHA512
ce79c86f3ac81b9e8786e49af78b13f1804635d64d19d2798b00e05b201433c0297a99cf09fabe4f05ddd0c4327ed72982049fbee4b209724de543bfd20ac188
-
SSDEEP
12288:PDcHFdwvfQky4ng/q2cTvw/oXTQUxTkGAVTeTveexB2sOr:PDcHF6XHBeWUoXv5lokee+r
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/2516-4-0x000000001BCC0000-0x000000001BE02000-memory.dmp agile_net behavioral2/files/0x00070000000231d5-11.dat agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 PekzLOG.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
MD5feb5236bd41cc5f9cfc5b5dc25e66d25
SHA16e3f599e8a57733655ddaa7703bbe939fd447216
SHA2566b64d5962e50dd590831dd7fbc6a09196fe03696d2767fc6416ac11edd2e0593
SHA5128e250045bf4acccd05ea0fddb54c936b9a1c7e25995f09815d31a86fbf9d28d17e71c33990420aa660e885c3950095499cf51d6944c4dd2735b2f993eb0b9507