Overview
overview
10Static
static
10AnyDesk v3...V).exe
windows10-2004-x64
1DLL Explor...32.exe
windows10-2004-x64
7DLL Explor...64.exe
windows10-2004-x64
7DLL UnInje...or.exe
windows10-2004-x64
1Everything...ng.exe
windows10-2004-x64
7Everything...up.exe
windows10-2004-x64
4LastActivi...ew.exe
windows10-2004-x64
9LastActivi...ew.bat
windows10-2004-x64
9Lastproverka.bat
windows10-2004-x64
3NirCMD 2.8...md.exe
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9OpenedFile...32.exe
windows10-2004-x64
9OpenedFile...64.exe
windows10-2004-x64
8Process Hacker 2.lnk
windows10-2004-x64
3Recuva 1.5...le.exe
windows10-2004-x64
7Shellbag_a...er.exe
windows10-2004-x64
10USBDeview ...ew.exe
windows10-2004-x64
9UserAssist...ew.exe
windows10-2004-x64
9processhac...up.exe
windows10-2004-x64
7Resubmissions
19-10-2023 11:09
231019-m9hf6agh68 10Analysis
-
max time kernel
379s -
max time network
391s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-ja -
resource tags
arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
19-10-2023 11:09
Behavioral task
behavioral1
Sample
AnyDesk v3.6.3 (аналог TV).exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral2
Sample
DLL Explorer 1.2/DLLExplorer32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral3
Sample
DLL Explorer 1.2/DLLExplorer64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral4
Sample
DLL UnInjector 1.3/NVTDLLUnInjector.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral5
Sample
Everything 1.4.1.877/Everything.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral6
Sample
Everything-1.4.1.1022.x86-Setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral7
Sample
LastActivityView 1.2.7/LastActivityView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral8
Sample
LastActivityView 1.2.7/Сохранить отчет LastActivityView.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral9
Sample
Lastproverka.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral10
Sample
NirCMD 2.8.1/nircmd.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral11
Sample
NirCMD 2.8.1/Скриншот hl2.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral12
Sample
NirCMD 2.8.1/Скриншот ucp.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral13
Sample
OpenedFilesView 1.80/OpenedFilesView_32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral14
Sample
OpenedFilesView 1.80/OpenedFilesView_64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral15
Sample
Process Hacker 2.lnk
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral16
Sample
Recuva 1.53.1087 Pro & Portable/Recuva_Portable.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral17
Sample
Shellbag_analyzer_cleaner.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral18
Sample
USBDeview 2.73/USBDeview.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral19
Sample
UserAssistView 1.0.2/UserAssistView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral20
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
General
-
Target
DLL Explorer 1.2/DLLExplorer32.exe
-
Size
598KB
-
MD5
326c06ca43356ca2aed1180f1974b4d4
-
SHA1
a94c8a92b55c7d5f06258daca70e9397110f389f
-
SHA256
4b6cf55e9d62c62f130dc0260f13367bc88113f04a3067eaf753dca5540d12e0
-
SHA512
4ef7abad84c51f734965c07a3311ac550b74229185ff9decc14adeb00b4b74aa369326f52da9721d4b189dd50b5d785107d342fb23d9c8e73a2f3d3fd96e6fea
-
SSDEEP
12288:tmDAgh1PBYwrWQGIKbB3vibk1tRpcMT6QWOkoSPygJGFz9ms:tQ1P1SQHGl1L55D2GFQs
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x00000000005DC000-memory.dmp upx behavioral2/memory/4936-2-0x0000000000400000-0x00000000005DC000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 0 4936 DLLExplorer32.exe Token: 1 4936 DLLExplorer32.exe Token: SeCreateTokenPrivilege 4936 DLLExplorer32.exe Token: SeAssignPrimaryTokenPrivilege 4936 DLLExplorer32.exe Token: SeLockMemoryPrivilege 4936 DLLExplorer32.exe Token: SeIncreaseQuotaPrivilege 4936 DLLExplorer32.exe Token: SeMachineAccountPrivilege 4936 DLLExplorer32.exe Token: SeTcbPrivilege 4936 DLLExplorer32.exe Token: SeSecurityPrivilege 4936 DLLExplorer32.exe Token: SeTakeOwnershipPrivilege 4936 DLLExplorer32.exe Token: SeLoadDriverPrivilege 4936 DLLExplorer32.exe Token: SeSystemProfilePrivilege 4936 DLLExplorer32.exe Token: SeSystemtimePrivilege 4936 DLLExplorer32.exe Token: SeProfSingleProcessPrivilege 4936 DLLExplorer32.exe Token: SeIncBasePriorityPrivilege 4936 DLLExplorer32.exe Token: SeCreatePagefilePrivilege 4936 DLLExplorer32.exe Token: SeCreatePermanentPrivilege 4936 DLLExplorer32.exe Token: SeBackupPrivilege 4936 DLLExplorer32.exe Token: SeRestorePrivilege 4936 DLLExplorer32.exe Token: SeShutdownPrivilege 4936 DLLExplorer32.exe Token: SeDebugPrivilege 4936 DLLExplorer32.exe Token: SeAuditPrivilege 4936 DLLExplorer32.exe Token: SeSystemEnvironmentPrivilege 4936 DLLExplorer32.exe Token: SeChangeNotifyPrivilege 4936 DLLExplorer32.exe Token: SeRemoteShutdownPrivilege 4936 DLLExplorer32.exe Token: SeUndockPrivilege 4936 DLLExplorer32.exe Token: SeSyncAgentPrivilege 4936 DLLExplorer32.exe Token: SeEnableDelegationPrivilege 4936 DLLExplorer32.exe Token: SeManageVolumePrivilege 4936 DLLExplorer32.exe Token: SeImpersonatePrivilege 4936 DLLExplorer32.exe Token: SeCreateGlobalPrivilege 4936 DLLExplorer32.exe Token: 31 4936 DLLExplorer32.exe Token: 32 4936 DLLExplorer32.exe Token: 33 4936 DLLExplorer32.exe Token: 34 4936 DLLExplorer32.exe Token: 35 4936 DLLExplorer32.exe Token: 36 4936 DLLExplorer32.exe Token: 37 4936 DLLExplorer32.exe Token: 38 4936 DLLExplorer32.exe Token: 39 4936 DLLExplorer32.exe Token: 40 4936 DLLExplorer32.exe Token: 41 4936 DLLExplorer32.exe Token: 42 4936 DLLExplorer32.exe Token: 43 4936 DLLExplorer32.exe Token: 44 4936 DLLExplorer32.exe Token: 45 4936 DLLExplorer32.exe Token: 46 4936 DLLExplorer32.exe Token: 47 4936 DLLExplorer32.exe Token: 48 4936 DLLExplorer32.exe Token: 49 4936 DLLExplorer32.exe Token: 50 4936 DLLExplorer32.exe Token: 51 4936 DLLExplorer32.exe Token: 52 4936 DLLExplorer32.exe Token: 53 4936 DLLExplorer32.exe Token: 54 4936 DLLExplorer32.exe Token: 55 4936 DLLExplorer32.exe Token: 56 4936 DLLExplorer32.exe Token: 57 4936 DLLExplorer32.exe Token: 58 4936 DLLExplorer32.exe Token: 59 4936 DLLExplorer32.exe Token: 60 4936 DLLExplorer32.exe Token: 61 4936 DLLExplorer32.exe Token: 62 4936 DLLExplorer32.exe Token: 63 4936 DLLExplorer32.exe