Overview
overview
6Static
static
3SideLoad1/ssers.exe
windows7-x64
6SideLoad1/ssers.exe
windows10-2004-x64
6SideLoad2/AliIM.exe
windows7-x64
1SideLoad2/AliIM.exe
windows10-2004-x64
1SideLoad3/AliIM.exe
windows7-x64
1SideLoad3/AliIM.exe
windows10-2004-x64
1SideLoad4/nvdrsvc.exe
windows7-x64
1SideLoad4/nvdrsvc.exe
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
SideLoad1/ssers.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SideLoad1/ssers.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
SideLoad2/AliIM.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
SideLoad2/AliIM.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
SideLoad3/AliIM.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
SideLoad3/AliIM.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
SideLoad4/nvdrsvc.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
SideLoad4/nvdrsvc.exe
Resource
win10v2004-20231215-en
General
-
Target
SideLoad3/AliIM.exe
-
Size
473KB
-
MD5
ed17abee766074018926ff48e0ce7a3d
-
SHA1
d6d3172176302db9ee6225ea06dc1667a814327b
-
SHA256
a8325bd88171952dfb45b16d8bf541e4fbe5d0e546c4e6f6d8aca32b96756dc8
-
SHA512
7dba4925e7aa66b172c76e294938385db09edaf652b751ca3464b03b6203387c07c13c93eafaa9707ec8ad03cc586b1d67abbc731ff6792d422f49a18c30ca86
-
SSDEEP
12288:Fn/NkmEfThSEAbV7eDg+gCBrH/oCGs06MXPHh5hPak5:h/NkmSzAADgXCTM/ThP5
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 860 AliIM.exe