Overview

overview

3

Static

static

3

be.exe

windows7-x64

1

be.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    359s
  • max time network
    365s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2024, 20:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    be.exe

  • Size

    464KB

  • MD5

    32a9507a62e5aca46f7ddf4821038f46

  • SHA1

    cf56bc9d4c8a123791ba2120367045749457b48b

  • SHA256

    d544789eb4c0edfa0682356346991091ed9ca53f67faa09fde19f5f1a2f5a5f6

  • SHA512

    d4486e7a45cfebc4eea12c1e89eee0123d881db317f306f0966e5ae115e9064c3b10472918e5136acb8f25f3ba1e2e54edf9a86c5e15339edd03ed4e9cd75b15

  • SSDEEP

    6144:hgSTNOvcz0aQqOXn6bsec77zU+JirG8K2YJTx2YNKpGcuVpiiOOHznbAOzEJ7WvU:G4O3ain64XzzJgBC2YNKpHW0kTbKJ2O

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be.exe
    "C:\Users\Admin\AppData\Local\Temp\be.exe"
    1⤵
      PID:1708
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {F929C18C-2B0F-46CF-B522-0923EB7FDEBB} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:1792
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:2984
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x514
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3056

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1708-0-0x00000000012B0000-0x0000000001329000-memory.dmp

                Filesize

                484KB

                Download