248ff44d78dda2d93a669bb7537b57fe271d243d1cb5bf6615276debc28a704c

Analysis

max time kernel
156s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:17

Target

26151dd2af6c3f572d15b54ff58e1b04.exe
Size

67KB
MD5

26151dd2af6c3f572d15b54ff58e1b04
SHA1

2c659efb3fd57a4f0b1603b740765c4b1c6cf9d8
SHA256

248ff44d78dda2d93a669bb7537b57fe271d243d1cb5bf6615276debc28a704c
SHA512

16864879a1fe7e6e704987c56acc3c0c7f74857d326199f84298cbcc16a42bebefbe48a0502be6ba0ea992e17ec209a4dba62268f52a4b082fe7fc5d0e0000d0
SSDEEP

1536:Im2w31fUGq+ALnEVqSGSX41ZNcPlOJfJjfRa06tx8JzSKlen5mQsthSVqbOe+:Im1lfsLnEVzX0Znf9Rux8JeoSmQsthcl

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	26151dd2af6c3f572d15b54ff58e1b04.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/888-0-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx
behavioral2/memory/888-1-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx
behavioral2/memory/888-5-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nbjs.dll	26151dd2af6c3f572d15b54ff58e1b04.exe
File created	C:\Windows\SysWOW64\nbjs.dll	26151dd2af6c3f572d15b54ff58e1b04.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	888	26151dd2af6c3f572d15b54ff58e1b04.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 4608	888	26151dd2af6c3f572d15b54ff58e1b04.exe	93
PID 888 wrote to memory of 4608	888	26151dd2af6c3f572d15b54ff58e1b04.exe	93
PID 888 wrote to memory of 4608	888	26151dd2af6c3f572d15b54ff58e1b04.exe	93

C:\Users\Admin\AppData\Local\Temp\26151dd2af6c3f572d15b54ff58e1b04.exe
"C:\Users\Admin\AppData\Local\Temp\26151dd2af6c3f572d15b54ff58e1b04.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\26151D~1.EXE > nul
  2⤵
  PID:4608

memory/888-0-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download
memory/888-1-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download
memory/888-5-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download