691adf26801f4345ea89e201f206f313bbd0f038a8038446ce28bab22911a468 | Triage

Analysis

max time kernel
31s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2024, 18:05

Sharing

Report Analysis Logs

General

Target

AssassinX.exe
Size

2.6MB
MD5

159ccf2c24870cfc7095ee220921404b
SHA1

a3ed8dcc9398d3ffe034abaac6df69fd707ea853
SHA256

686fe37062707c4f1d2fcb9466a5c04fddb53b42c359fd175343e14ca36d9063
SHA512

9792380cffbabff8377fd479983b2f4704078b08a1ea5b959d3b8072d2f2f22ed085309647990f44351099af0cd62c0be7abcad0d304d64b87764299fb621857
SSDEEP

49152:uMsf88qSY9AbM9kSERGxVpOfe9PQeQMkez0NdtEbl3ID1PjFRbHXMF8XkV9n56X9:Nsf8jj9x9kSERGbRQ9i0jti2Bbnb1ol8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe
1288	AssassinX.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	AssassinX.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4484	1288	AssassinX.exe	81
PID 1288 wrote to memory of 4484	1288	AssassinX.exe	81

C:\Users\Admin\AppData\Local\Temp\AssassinX.exe
"C:\Users\Admin\AppData\Local\Temp\AssassinX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads