b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19

Analysis

max time kernel
142s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 02:16

Target

b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe
Size

404KB
MD5

d869aa5a6a0e1f09630d25135a8a1cba
SHA1

3f5d9764ef92f129833039cb0abf81ab6ee6ac71
SHA256

b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19
SHA512

d07aae9af85f8524ab02cce7a8c75ca3c26c825b20748d872ac39a5f365cf97e1c232acbbda957080319d9b6be0494ee94e4e313d1550abc41b28c85625599eb
SSDEEP

768:WtrYLOAb8u1n/DqPzR8lSvXpvQTf2z5JXhAiycIdnaBYwrYiaf0Is:qcLOs8In/mpfgI5JXpycIdnawiac1

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4332	nemhost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1676-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/1676-3-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-11-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-12-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-15-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-16-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-17-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-19-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-21-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4332-23-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\IME\nemhost.exe	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe
File opened for modification	C:\Windows\AppPatch\IME\nemhost.exe	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1676	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1344	1676	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe	94
PID 1676 wrote to memory of 1344	1676	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe	94
PID 1676 wrote to memory of 1344	1676	b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe	94

C:\Users\Admin\AppData\Local\Temp\b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe
"C:\Users\Admin\AppData\Local\Temp\b93cd3da0eb6bb0147a63ab5d82ec568606535f687ea2f992276eb8a57fe1a19.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B93CD3~1.EXE > nul
  2⤵
  PID:1344

C:\Windows\AppPatch\IME\nemhost.exe
C:\Windows\AppPatch\IME\nemhost.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3940,i,4410927054363474912,1110143490611443301,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:4536

C:\Windows\apppatch\IME\nemhost.exe

Filesize
409KB

MD5
3a5ad73ab5e0ee16ae186f7359b4e5eb

SHA1
0f4aef08a3d705d1c80eb9a1ba7a14dbf60f496b

SHA256
cb6d0624a26573b032ebd91569db62fc6b4f70f737a51c49c214acf617196170

SHA512
98d40c6121d5bca336d84aabd26a6eaf1c6a7ee0a3e8f74589a2555e3b0e7ff00154a1de93364eabf21c493ca1d0af0ae09da54c4524b7ce213629f2cd24ae73

Download Submit
memory/1676-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1676-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-11-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-12-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-15-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-16-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-17-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-19-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-21-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4332-23-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download