825bd0d23e932c6d888c3ef3b33aebd53b166441b94560774dffbcaa2a7502ef

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c038cf83ca3aec6f4a2c94954692919.exe
Size

272KB
MD5

4c038cf83ca3aec6f4a2c94954692919
SHA1

0ac026fe2e908057791b98e64a6adf7826b278a3
SHA256

825bd0d23e932c6d888c3ef3b33aebd53b166441b94560774dffbcaa2a7502ef
SHA512

d551cf769fe80b6a18a5a63e4b6ca1667513222cbd9b557eae6d37eed8aafb2907ef614d036c7dddddc8073796570260a42a7dbf36ce2812f717a55932aa5535
SSDEEP

6144:DUzN2DmaXkT3mOde4/sbt51O5VrmJ5fh9yrHU4:DU0Dw3vdeqsbt51SrOByr0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
376	an.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\an.exe	4c038cf83ca3aec6f4a2c94954692919.exe
File opened for modification	C:\Windows\SysWOW64\an.exe	4c038cf83ca3aec6f4a2c94954692919.exe
File opened for modification	C:\Windows\SysWOW64\an.exe	an.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	4c038cf83ca3aec6f4a2c94954692919.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	4c038cf83ca3aec6f4a2c94954692919.exe
Token: SeDebugPrivilege	376	an.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4112	2332	4c038cf83ca3aec6f4a2c94954692919.exe	97
PID 2332 wrote to memory of 4112	2332	4c038cf83ca3aec6f4a2c94954692919.exe	97
PID 2332 wrote to memory of 4112	2332	4c038cf83ca3aec6f4a2c94954692919.exe	97

C:\Users\Admin\AppData\Local\Temp\4c038cf83ca3aec6f4a2c94954692919.exe
"C:\Users\Admin\AppData\Local\Temp\4c038cf83ca3aec6f4a2c94954692919.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4112

C:\Windows\SysWOW64\an.exe
C:\Windows\SysWOW64\an.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\an.exe

Filesize
272KB

MD5
4c038cf83ca3aec6f4a2c94954692919

SHA1
0ac026fe2e908057791b98e64a6adf7826b278a3

SHA256
825bd0d23e932c6d888c3ef3b33aebd53b166441b94560774dffbcaa2a7502ef

SHA512
d551cf769fe80b6a18a5a63e4b6ca1667513222cbd9b557eae6d37eed8aafb2907ef614d036c7dddddc8073796570260a42a7dbf36ce2812f717a55932aa5535

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
82f26e6d412d36a5f9069932ac4fcf06

SHA1
e1a0b769c3df9d3cc8621730b695c66abf02996f

SHA256
534e25ae410cddb91251c0b7e1bedda6b1cbae361fc9d3ea580b30b9bee46d1d

SHA512
60f57bae2ef375da4cc062b211ed407469684b1a4fb3b470438feb128de49bb0788f190fcc458357a961f6bf4dac2868c59dc7fcfbe91f346e140b88ff3e6055

Download Submit
memory/376-15-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/376-14-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/376-13-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/376-12-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/376-11-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-3-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-8-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-5-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/2332-4-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-0-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-2-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-18-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download
memory/2332-1-0x0000000000400000-0x00000000004C915D-memory.dmp

Filesize
804KB

Download