Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
26-11-2023 16:52
General
-
Target
Nedqm.exe
-
Size
86KB
-
MD5
634969e8d7e126dba7d9df1ba2495850
-
SHA1
5678e50a87be9b0c46e52ef259e5624022b80757
-
SHA256
9371ee974c4ebf35be61c05afbd3d3f73ac8d130346655b3374f7d9a779195d8
-
SHA512
01cdbf8c51a874bb5edfb8d3c6db7855abeb84ea41fb407fe7afc0052c54f918f3cbfd6567af4fd951a6c32c6e76a327bccc8a2e81e3a08bf19b9f5affc1a80d
-
SSDEEP
1536:CaCQ1GTdMdAP82dlvrmUrKiKpp7lpQJ5m1zr3iRNhtCCKyqw:MtIhqlDm0HK7qm1vi/z3n
Score
6/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nedqm.exe"C:\Users\Admin\AppData\Local\Temp\Nedqm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
512KB