0e3e7f87385f74fd184798f3428482595f3065ff8919bf33beeb6e31c57a84e5

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29a26edcd61d00d240cb2b7334d14131.exe
Size

17.6MB
MD5

29a26edcd61d00d240cb2b7334d14131
SHA1

5aafa979424339ffbec58661f044f8d0c73aa545
SHA256

0e3e7f87385f74fd184798f3428482595f3065ff8919bf33beeb6e31c57a84e5
SHA512

363745401275eee956bde0b646c962b1a50683c817205f2e33e42f34836362518822438dcf63e2ccdb1bdbbf78be1e8505f36657da2063ef53afd301ca06511d
SSDEEP

393216:tg0X0FTpukcMyIRMLBTIo661372/op0+8BVy5J70gjQOTJAZ8sa:tg0XkMqPGlt372/oa+8BViJ7NjQSg

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

29a26edcd61d00d240cb2b7334d14131.exe

pid process

2976 29a26edcd61d00d240cb2b7334d14131.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

29a26edcd61d00d240cb2b7334d14131.exe

pid	process
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe
2976	29a26edcd61d00d240cb2b7334d14131.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

29a26edcd61d00d240cb2b7334d14131.exe

description pid process

Token: SeDebugPrivilege 2976 29a26edcd61d00d240cb2b7334d14131.exe

description	pid	process
Token: SeDebugPrivilege	2976	29a26edcd61d00d240cb2b7334d14131.exe

C:\Users\Admin\AppData\Local\Temp\29a26edcd61d00d240cb2b7334d14131.exe
"C:\Users\Admin\AppData\Local\Temp\29a26edcd61d00d240cb2b7334d14131.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000074990000-0x0000000075140000-memory.dmp

Filesize
7.7MB

Download
memory/2976-1-0x00000000004F0000-0x0000000001698000-memory.dmp

Filesize
17.7MB

Download
memory/2976-2-0x00000000039F0000-0x00000000039FC000-memory.dmp

Filesize
48KB

Download
memory/2976-3-0x00000000060D0000-0x00000000060E0000-memory.dmp

Filesize
64KB

Download
memory/2976-4-0x00000000768A0000-0x0000000076990000-memory.dmp

Filesize
960KB

Download
memory/2976-9-0x0000000007DE0000-0x0000000008384000-memory.dmp

Filesize
5.6MB

Download
memory/2976-10-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/2976-11-0x00000000060D0000-0x00000000060E0000-memory.dmp

Filesize
64KB

Download
memory/2976-12-0x00000000076D0000-0x00000000076DA000-memory.dmp

Filesize
40KB

Download
memory/2976-16-0x00000000768A0000-0x0000000076990000-memory.dmp

Filesize
960KB

Download
memory/2976-15-0x0000000074990000-0x0000000075140000-memory.dmp

Filesize
7.7MB

Download