Analysis
-
max time kernel
116s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
545489147a9e44cbc2218e4b34b758f4.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
545489147a9e44cbc2218e4b34b758f4.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
545489147a9e44cbc2218e4b34b758f4.exe
-
Size
4.4MB
-
MD5
545489147a9e44cbc2218e4b34b758f4
-
SHA1
a2848e1fc4de6e91a759502bb6c6601afb70bdf0
-
SHA256
28fee647fb51161976bc8c89e81194fbeb1dcad71fb9926e99f5192e2f8486d4
-
SHA512
58dd4115c7ae8831349475f39cd81343dc5c6466184c9808b9dbc30261e6dd6bb0df0e52dd58f91e27b0989f023dfc0c0bb0aa1f4544319553dff333fbc7b90c
-
SSDEEP
98304:RtwuT/W5AUd2BiH3SdPVNHTlME9BbfFNpv/s8PQpsf7lrg:RCFHiHNyEzBNR/s8KsNg
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 545489147a9e44cbc2218e4b34b758f4.exe File opened for modification C:\Windows\assembly\Desktop.ini 545489147a9e44cbc2218e4b34b758f4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 checkip.dyndns.org -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 545489147a9e44cbc2218e4b34b758f4.exe File created C:\Windows\assembly\Desktop.ini 545489147a9e44cbc2218e4b34b758f4.exe File opened for modification C:\Windows\assembly\Desktop.ini 545489147a9e44cbc2218e4b34b758f4.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe 4512 545489147a9e44cbc2218e4b34b758f4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4512 545489147a9e44cbc2218e4b34b758f4.exe