Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 08:49
Behavioral task
behavioral1
Sample
6126698305d4a23c68333e54bb162a9d.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
6126698305d4a23c68333e54bb162a9d.exe
-
Size
247KB
-
MD5
6126698305d4a23c68333e54bb162a9d
-
SHA1
b9411d34a658297f4a00e085f1a91dc5178a982b
-
SHA256
52c7f0ee51dafe2eac0077ec0e3010f496acc168b8c69edd005e770d101ad30a
-
SHA512
b1b3abe1359f7a4cf782e515c11c34d79e16a7b730648f515cd9c55e8ee72015f38338f6823e79e4e3fd1607bfcfebc8b5b3018ebbe328f1dc2048900c47b81a
-
SSDEEP
6144:cFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsl:8R72EqluswR45JTnaEY2
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5096-0-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/5096-3-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/5076-2-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5096 set thread context of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17 -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeSecurityPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeTakeOwnershipPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeLoadDriverPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeSystemProfilePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeSystemtimePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeProfSingleProcessPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeIncBasePriorityPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeCreatePagefilePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeBackupPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeRestorePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeShutdownPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeDebugPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeSystemEnvironmentPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeChangeNotifyPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeRemoteShutdownPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeUndockPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeManageVolumePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeImpersonatePrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeCreateGlobalPrivilege 5096 6126698305d4a23c68333e54bb162a9d.exe Token: 33 5096 6126698305d4a23c68333e54bb162a9d.exe Token: 34 5096 6126698305d4a23c68333e54bb162a9d.exe Token: 35 5096 6126698305d4a23c68333e54bb162a9d.exe Token: 36 5096 6126698305d4a23c68333e54bb162a9d.exe Token: SeIncreaseQuotaPrivilege 5076 iexplore.exe Token: SeSecurityPrivilege 5076 iexplore.exe Token: SeTakeOwnershipPrivilege 5076 iexplore.exe Token: SeLoadDriverPrivilege 5076 iexplore.exe Token: SeSystemProfilePrivilege 5076 iexplore.exe Token: SeSystemtimePrivilege 5076 iexplore.exe Token: SeProfSingleProcessPrivilege 5076 iexplore.exe Token: SeIncBasePriorityPrivilege 5076 iexplore.exe Token: SeCreatePagefilePrivilege 5076 iexplore.exe Token: SeBackupPrivilege 5076 iexplore.exe Token: SeRestorePrivilege 5076 iexplore.exe Token: SeShutdownPrivilege 5076 iexplore.exe Token: SeDebugPrivilege 5076 iexplore.exe Token: SeSystemEnvironmentPrivilege 5076 iexplore.exe Token: SeChangeNotifyPrivilege 5076 iexplore.exe Token: SeRemoteShutdownPrivilege 5076 iexplore.exe Token: SeUndockPrivilege 5076 iexplore.exe Token: SeManageVolumePrivilege 5076 iexplore.exe Token: SeImpersonatePrivilege 5076 iexplore.exe Token: SeCreateGlobalPrivilege 5076 iexplore.exe Token: 33 5076 iexplore.exe Token: 34 5076 iexplore.exe Token: 35 5076 iexplore.exe Token: 36 5076 iexplore.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5096 wrote to memory of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17 PID 5096 wrote to memory of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17 PID 5096 wrote to memory of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17 PID 5096 wrote to memory of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17 PID 5096 wrote to memory of 5076 5096 6126698305d4a23c68333e54bb162a9d.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\6126698305d4a23c68333e54bb162a9d.exe"C:\Users\Admin\AppData\Local\Temp\6126698305d4a23c68333e54bb162a9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
-