7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

max time kernel
22s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 16:34

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Size

32KB
MD5

a68efe8ce746b28caf89d49226c7be0f
SHA1

f6d8126a98ed58f6fe79029d001f3368ce05794d
SHA256

d7aadffd168139ae09e073e9154a8fa6a6b6be547d3beae1e157adeb1bad2c07
SHA512

5f2f88f6fc306f52ff53a8ab52596872ee12227c476d448ea547243bf9bd77545ac1023e6d60cf7fa8b185844edb40ae292fe97ed483a6f1e27e37e440153145
SSDEEP

384:5l3kcQnkUoSsJGG5ZfB3yIwt4U3Qu0/7FTgPtTFAqzm6osSic:5WcQneSwP5ZRs4U3CeFoso

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

HEUR-Backdoor.MSIL.SpyGate.exe

description	pid	Process
Token: SeDebugPrivilege	4008	HEUR-Backdoor.MSIL.SpyGate.exe
Token: 33	4008	HEUR-Backdoor.MSIL.SpyGate.exe
Token: SeIncBasePriorityPrivilege	4008	HEUR-Backdoor.MSIL.SpyGate.exe

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008

memory/4008-0-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/4008-1-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/4008-2-0x00000000010F0000-0x0000000001100000-memory.dmp

Filesize
64KB

Download