Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe
Resource
win10v2004-20231020-en
General
-
Target
150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe
-
Size
162.6MB
-
MD5
156c3f770b5953b41e62a5d6814384d6
-
SHA1
326d11e83bb1572bd00d99ac641b13e99f2eb2b6
-
SHA256
150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa
-
SHA512
84f4dd49501869ffa3593dc547f8440274e701c541f063410d59313dc707a75d4f23b16d99ab8ec07b321bc86c1c73c2936ff94de609b12273fe0361dff88d69
-
SSDEEP
1572864:IxYDr3VLmrVf6T9jCykX7LBZY56W8SGc2e:IxYDrFLmhiT9joQU5c2e
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 4772 150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe 4772 150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe 4772 150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4772 150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.net\150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa\2yuR1BF1o1CypwvjmfGkePrpZ4JZI2c=\D3DCompiler_47_cor3.dll
Filesize4.7MB
MD503a60a6652caf4f49ea5912ce4e1b33c
SHA1a0d949d4af7b1048dc55e39d1d1260a1e0660c4f
SHA256b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3
SHA5126711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4
-
C:\Users\Admin\AppData\Local\Temp\.net\150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa\2yuR1BF1o1CypwvjmfGkePrpZ4JZI2c=\PresentationNative_cor3.dll
Filesize1.2MB
MD5ef01a6c206c65369dd05ca5aff258aa2
SHA1219cc335309f7a6b48b3aa0554f228d59cfd0e7c
SHA2566342b0b0c9a864e4dca5d6d6d60d31ff4d7f02232d63fb45958035b5db77980e
SHA512c35f31bcc766a0c1d35a82197226222cfe7eb198a4df8b18acfb174a8654fd2b77e20fe5dad7be7c423e293bbb37d0d0b6a763b2fcd93c3bacd80077a14642ad
-
C:\Users\Admin\AppData\Local\Temp\.net\150cb4617dd9b5d97af15265195519724fa97bad47f548fc5b950158ccc54efa\2yuR1BF1o1CypwvjmfGkePrpZ4JZI2c=\wpfgfx_cor3.dll
Filesize1.9MB
MD51bd451c0ea27f1c3cbaf428e11c6ffe6
SHA130ed8e98b08ecf3c583e81d78258a292780bc755
SHA256292f74c265648690eb26e5008f4aa4ffd8774ed33682296970a063535340ebc5
SHA5129b7f7511b7b6eaedcdba7095aa4129b653650c8be5f889055c6649242aa6c3119c26ca54e9329dd3d683955ffa99125585e8d37e915bf4e9924f86c76d50e9af