c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 09:19

Target

c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe
Size

6.3MB
MD5

b949b8b757152cf0a9121396c521a21b
SHA1

e2935ac6d3383c3b01152f769bf3b10d48dc2398
SHA256

c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762
SHA512

989b47473075ecb9bb23ab54d45cdc31a26e524f9d0b75dcf13ce30952c54c60e95c11a4477934f9fe257b0858a4c2bb93b8ea0852639cc7bab0701c020ab4bd
SSDEEP

49152:SzSYvjnn5+GqlLPDqz0pinzxIVkHfl+Anf0jT5EfW3sCIm0mbzQI81skFrZ:g59EL608xIO/CEAdtbMI8fZ

Score

1^/10

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
2136	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1188	1964	c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe	28
PID 1964 wrote to memory of 1188	1964	c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe	28
PID 1964 wrote to memory of 1188	1964	c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe	28
PID 1188 wrote to memory of 2136	1188	cmd.exe	30
PID 1188 wrote to memory of 2136	1188	cmd.exe	30
PID 1188 wrote to memory of 2136	1188	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe
"C:\Users\Admin\AppData\Local\Temp\c447279d61d7c61961398a59765ff235e73cd35555fbf4687ff860025b766762.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\cmd.exe
  cmd /c "C: && cd C:\Users\Admin\AppData\Local\Temp && taskkill /f /pid 1964"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 1964
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2136