Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bTuY.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
bTuY.exe
-
Size
36KB
-
MD5
eb4b0035fc8b26d8c5f98e2d2df7a077
-
SHA1
46e3bf60ad761804f192b7d7c49aa6101a6ca9a9
-
SHA256
df81eb307e177a41a1bc84a889459f61365eeeec514a03aab0665d8d1e302b26
-
SHA512
91533e3e0a697ea926c54a51b5ad6cd35e673f483fa122bfb8d6b7e4e0b493507c34b8948403cca1d92941bdca0c37d1cc246aa3722458749bf145f6b242582f
-
SSDEEP
384:5ULdClEUdi/dMkt1QmY/GKSEZePC45SY2OzRLTm3yilqr64qbUyvGb:5CUEUdi/dMc1tEZeK45SsbcvGb
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 8 pastebin.com 9 pastebin.com 10 0.tcp.sa.ngrok.io 143 0.tcp.sa.ngrok.io 212 0.tcp.sa.ngrok.io -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3584 bTuY.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe Token: SeIncBasePriorityPrivilege 3584 bTuY.exe Token: 33 3584 bTuY.exe