Resubmissions
25/04/2024, 01:21
240425-bqxwyscg54 7Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 01:21
Behavioral task
behavioral1
Sample
LaZagne.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LaZagne.exe
Resource
win10v2004-20240412-en
General
-
Target
LaZagne.exe
-
Size
11.3MB
-
MD5
282df7bcb720a5b6f409caf9ccda2f75
-
SHA1
0e62d10ff194e84ed8c6bd71620f56ef9e557072
-
SHA256
3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
-
SHA512
74bbcefb87c037ec93312f67b739c2486258d83e0fb7628352a1dd482c0277a82073427856c0848cda451b7322faab0ae2e6878501c2867827ce6bd9798f3229
-
SSDEEP
196608:0cHu78K//UoEkXuWJysVYvsOfhumHhtdIQLOMIdiwXa6vTVzy/BOfN1XZuoJnB:Bu7L//HEnWJIuahtaL/dg67RywfNxZuu
Malware Config
Signatures
-
Loads dropped DLL 54 IoCs
pid Process 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe 1344 LaZagne.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 1344 LaZagne.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1344 1720 LaZagne.exe 29 PID 1720 wrote to memory of 1344 1720 LaZagne.exe 29 PID 1720 wrote to memory of 1344 1720 LaZagne.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD510cd16bb63862536570c717ffc453da4
SHA1b3ef50d7ac4652b5c35f1d86a0130fb43dd5a669
SHA256e002a1bd6fba44681d557b64d439585dba9820226e1c3da5a62628bbaa930ae3
SHA51255ee581c4005901661efaf9aad6ea39b2b2e265579539d464d62e4209638567b3b9fdd945d0bed0a1047f977d374a5707a970c621ca289077e2d6c5aeca491b1
-
Filesize
18KB
MD56a6f368802fefdd7c62cfa942e07ae51
SHA11012e2163d64b374fc784cb15205010492879d5d
SHA256b7e6f1144d596ee1784359f384a3498bab32804add8c24bcf65964b413fb508d
SHA5120dd5fb0bd23c8215254447d6e77d5bf95df8bf1c2e9f6f27dea1040ca496bd4135b40efe7f3bd4f8ab8300456a582b1596aeaea495dccab8fd4c7acf3c0034d0
-
Filesize
21KB
MD5ac718755753807cef7c5026dd8a58027
SHA14b39d0a3d442fbebcc7ac5fe35d3752dad87f58b
SHA256b0418241a1c8c2ac1a230d586b0200f9e1033d1833dfd5f48719a1b611ae3fbc
SHA512ef9b9f04ec1da1c63e1d1e8bdcf3d929dab9725383f58c94554aea801ef39f47c1a97115a57b4ae7390db59a979478940ea9e2b41003796745c0bfb159955a1e
-
Filesize
18KB
MD5efc8f224ea2f4af24b13329971cf551f
SHA1a16fdedefe4bc6201243301624329525199e4f8d
SHA256fea7c286fb3140a8d8739f2961a524c00dd0ad086f1d4517b74a84d7bb7dc18b
SHA5125405abb3a52489b0c6a94cc1b840dfae2bded14e53f39bdcd4b8d8f0d8bfa9b43138d5a6eba1a1804d6fc2efe4dd21df1e223d4c77dd07bcafdedd7a4031512e
-
Filesize
762KB
MD54dbdcd4c1d91ebb19d0520ad80f35d78
SHA11a2e0de2cb1c5be36d3e7ad691bf6b27436dbdb7
SHA256c74288cc76f67f9f3be2ce61b3c4b1df78b082f4d55dc4dd7b68f6a4803ea47e
SHA5128a298985628c895a67adf9538e92ff7527219163dc1c491f5c250bd36532d66f9d9530c04778d535535eeb0f22dcb4c55d22ab3459b6e827d614ca1e7c647031
-
Filesize
1KB
MD56fe7232e13f5f8307c037b54fe0dcc10
SHA1510075454d9179d1c6669df67f126213aabcb99f
SHA2564996109560a79774034a05b398d64b1b441c49f0f03682c4683554c59dd47e5c
SHA5128893febd884f6411025ff9df7d0ef2dbc756baa93903423e805b5e981273838567f2ea60d072d4d98fe9b2f2c25a85800522cebc5e832a3256d4c10605085725
-
Filesize
1.2MB
MD5b4c6e2b5c1919c6868c42add3a54355b
SHA16363849bd436925c361cf1fb9f571c1a23a1fe79
SHA256d9d86d637f6c615e76a6d408af92d0fb1e771b517a47cada08fe4b287c588ab9
SHA5121d4fbc38d85a70401f56920645ca45bc0b48da119555f02e05926b9a5f11b04fcc2913b7d2054cf1489f589e54d2c42383700fcf5e3543822a00d84c0dabccdd
-
Filesize
2.8MB
MD55fe9ce650191d39187dd05beb5013e90
SHA1673ebcd5c4571f9d84486109ab283e4e2a9886c2
SHA256824319c4a3db0ed7a67eaab0afcd61692c914a84924128f0fcf5466b85449d0d
SHA5123b69d13d0254e3bda34173d32995da580a0d27babc6c2dd20ed4a8f56a8c2b72d1ceb705c4edae27ef9cae478d3cb5745231b0af650e17180d36b5742906d833
-
Filesize
970KB
MD5aad2e99881765464c9ad9ccdbe78f0e0
SHA18634ce21a2683674210e836822fda448262e2e16
SHA256e6287f7ba5892c99da70e9785d320a665809ca8e657a64b9fef1e8afcfb6a2f9
SHA51268d2e898cdd73a3ad41ef3db7a149588a82629ac0628c07606f009bd6a92a62f9816c995b1794c8a957a4f3c55a72fcab17a400a2f55016a0ee8d773a172d002
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
87KB
MD592075c2759ac8246953e6fa6323e43fe
SHA16818befe630c2656183ea7fe735db159804b7773
SHA256e7af6119b56ddd47fd0a909710f7163d7ef4822405fc138d24e6ce9de7a5022f
SHA5127f3a4409859695f53291c96dd487bca2649815bad5f4610c2c6f92777411d39210e293d962573a20dfe73ea15331de7e6c18b017ae1d6f226387eab1fc1f586c
-
Filesize
131KB
MD52787764fe3056f37c79a3fc79e620172
SHA1a64d1a047ba644d0588dc4288b74925ed72e6ed4
SHA25641c593c960f3f89b1e1629c6b7bd6171fe306168f816bef02027332a263de117
SHA5121dc5bb470be558c643a3f68e23423697384bc547b1192cd398dff640e28f7df85563bc87643cdcde9b8b4f880f272e13a673a018ae251e100bd99790f993afa0
-
Filesize
38KB
MD57808b500fbfb17c968f10ee6d68461df
SHA12a8e54037e7d03d20244fefd8247cf218e1d668f
SHA256e2701f4e4a7556adab7415e448070289ba4fe047227f48c3a049d7c3154aff0b
SHA512b4239e792141bcf924f61bfd46033934337079b245f423b34820d36c6599ca35ab06bc525acfff4cafa75e31975fcd0409dedd203377d642fc5dc55ec2c1fa27
-
Filesize
251KB
MD5ab582419629183e1615b76fc5d2c7704
SHA1b78ee7e725a417bef50cca47590950e970eae200
SHA2565a45f7cd517ad396a042bc2767ae73221dc68f934e828a9433249924a371ee5e
SHA5123f38441dd0b88b486dafaa1e15d07f0ee467a362c1603071a2fa79de770fa061ced25ca790f0d3139f31178c719cc82ac88601262e2a0ca809708dfa3f6f76ca
-
Filesize
27KB
MD5a48af48dd880c11673469c1ade525558
SHA101e9bbcd7eccaa6d5033544e875c7c20f8812124
SHA256a98e9f330eeaf40ef516237ab5bc1efac1fc49ed321a128be78dd3fb8733e0a4
SHA512a535dadb79c1ca10506858226442d1d1fb00e5d6f99afa6b539e2506a6627a7bd624a7ee2bc61f55c974113de80fd7a95e6c18e9402736d32d5099077ca1b913
-
Filesize
84KB
MD5244d92824ef54b139ecd4f2b58a5d9d5
SHA1ff5696f6e3dc42e578a580299ac53d8c5e11d917
SHA256fd55c3e3b2863425050619b8d42fe19cf06c1c8e2e11f7076e1f4422663e6851
SHA51210fba938064bca2b9163d6c0d0a0361d0ebd896e32346cade3e4a439475c223ced59ac8f9c51727d5556149b14990ab62ee6769c35cf067aaac5d63dd5d4688f
-
Filesize
18KB
MD5f58b1e1f6168d526473289f5f15cc66f
SHA1ef9d3d6307dcbfc3b357b2dd30a75b08998c09b5
SHA256ee778641ebc47383926d62d56612f25487151a183d76e3a2d013f658f6917918
SHA5121278a6be2baaf05696c22db325faf2c90bc319fcb57daa6fcd2f2d95c1074797247d4a5df4d7e46f7177f1da07e9133f45c61c28e16a71b8d82ff627671b52f9
-
Filesize
19KB
MD5833aa996973b87eff6cdfea246d22999
SHA1b89dc8d3f4aa772e32de79bb485c48054aa64361
SHA2568831b1419c675ac71305ed616fa6aad97b068cc55796d1afc7593a1df2491226
SHA512dfd12536e519f45294daa070aa35a8b1d32660e718e894f5e782d8bc093911b32f01052a1a9a79746e604b861d3794a4fef3b5bcad900c63460f243ff31fd416
-
Filesize
19KB
MD55e7d46dd3aa282ea86a4e35f4753461b
SHA15a7d5ddb39b8c75f4cf6a8724dc2c6b33393ed1f
SHA25607cc434e4af6d72a0e2e4313ca2be77dfe0b3a7de9d71e08131f840e0a6028d1
SHA5129522b5aa48fe5098d72ec85dec7aaf02ff8394caf967a5b67d9c88033a248a22715b159ff3ccf58e1b9e6d3470c403c6c45ba17527ee9f4f1c302e161c0cfac1
-
Filesize
22KB
MD520ae5bab58dbf000696a24d009c24cf9
SHA1a601c57c4b357a183a962007448ae6a47c066c98
SHA256aaaea589cd89555c7e5eb464d1f98a1e47443767d2d7571bb11e924afde9b1a9
SHA512d9e5443d7e7a63fe1d380e38add178fdbc080f67614f13882c8b0f933b01c5f35f213859dcc772e6068f5b24345c707834f4aba374deea0de339206f65404134
-
Filesize
19KB
MD508bae65704d7f953c89be68fe2f27f85
SHA1e09579903b7fb9ed8fddd4ea7af800c71d4278e5
SHA2568fd3e70e50f9087d73c29fffd0e16bc644c9e0e5802f2a5f07b6d3b5c0b4b0dd
SHA51234bd09c7a22e34ce75ad3f4ff7cf93143600c9bbee24207d9711f731f68f49804ad2ac4843d58f224d22100da3ee779c86c6df1a87179cd74b8df74b7fea4e65
-
Filesize
20KB
MD5baac525aac4f2735d60692a6b9e3ba52
SHA1ef9188a8daf0d7d1740aad8c225845ca2fb82c66
SHA25692baddffec31289e7dafc15ab56a49d93ceb266e0f0d120a5ef0fb1bce20dca1
SHA5120fda206266e44181f83b4ab49ac9b0a3e75a3fc8e86dedc74e3ed7517a6af950e7f196bcb2cd50ae220cc5ce4c2d58ad4047f8aa9da57ff3645a97aa653618f4
-
Filesize
19KB
MD55bff09fe93358508fe966cf8ca0f81c5
SHA1da0e180079ed9a23a03b6181f44a6db40f7bba22
SHA2561ff08dae5644a72047772e616537f4bd80414134944eb49168447e14b83ea9b4
SHA512cd01bf9db64cedc6ee1abce8e4cc880aa3473961d3c4d5a93b61b514ff9665ed8929b8f2cb4000994bafcd07ae708fec6ae99115e5940b4f95acc0bc865c6cdb
-
Filesize
19KB
MD58636ad6ba8c5c9efcd5afea665ead4ca
SHA1858865f45405a99f50838806de75cc1cf06cce64
SHA2567788524de88adae43062d96d50a912ddb5ca2afbb527a628a87f842a98bc5e0b
SHA512bd9d55ddcecd1631c29f1ced8a1e7a82ff4435253095ee6bbfaacca60f6321fc3cd5f67d632e35a35dcc8b604cb7a13b378a0bfed340bb7f77ac207ed10cbbe3
-
Filesize
27KB
MD508fea493e6cb3cdd267b9fc9fd0c6fd7
SHA1447427cb9edb6ca4bdfc6a63a95b326a0ab6d55d
SHA25693b7d156846ef90e76fdfc05987c28b437644f0592acd82b179fc72b8cf9c395
SHA512ad78ab3774d79c400229db56202e15ad22e5a14d20e9d5e554f6edbcb01ef18c9c1bcbc6569ed6b698cce1428e15c63a970b8f350c862a580b468a67401793dd
-
Filesize
19KB
MD5d911e8d952088498848600dcb20efb2c
SHA1e5afdec39480e945c12ef86f77bd719ccf4b1de9
SHA2569ce47ff49fc0dcab1ad8ee594e218d8cce299d5e23473ff1ecb868023bfcc533
SHA51288fd72d76f57af3d925e757532bc29317a7f35b7eb0d00b6534647fee6162e789d9a03ab9fed9e1af357745bc6e765bbc648f5ffac49c11a6d7f2bae2c071a09
-
Filesize
23KB
MD53424b3cad00b22c071b2bd376084b8b0
SHA192cdc77411fa5515d188bd34d921b45e1005b4f8
SHA2569d42ee159384e8b1aa98bfc5b59a4dcdd808cac13d0ee9457dc5c19d3020c55f
SHA51269a71d9dc3a27f2a5253ec98cb32d8961a596606c6f260704a7bcfe77aafa590df9da9ebb88b259926e20efbca18f0bbdac5d18ce97e467540591f8e9a5f4b98
-
Filesize
24KB
MD5c9dc0be8cb2970e4c49094ccfa16adac
SHA12a38ce151ce9c93ae0737d29fd358224f535f566
SHA2569e531d7ced9398b85730e9887fe986aabbbe0247f35db2a7a728c0b9278495ff
SHA512efa3b09de2d4ef3783dbb8db37820dd5e203a679666b821cdae356b0571ffc8ff6f364f3e4c37bbafcf0b024b4a2d2976326b646492d5d6d3dcef5a4ecd94a7f
-
Filesize
24KB
MD5742d61ebf0e70756fb017f80ea8cebcd
SHA16cc4d970c3ffd313b57c87a67ce1dda2a8b67432
SHA2569a14823aa0cbefb03bf9debee20e0f593af5e78d0fe0a6de679146a680e99f29
SHA5126fc30b6d060fcb3a4dd4852d8e3a2bff405954d17dd8d8b6e0d1ddac7fbe40246836d0785c3ea730eb8dbf17fd3d2dfba68ceef2a798efd846cf23c107335996
-
Filesize
21KB
MD521cdb83da91bcedb3ea3463f736ce6dd
SHA1de1b0764b7eaaaea2a88fc1fa564464bcc4bd218
SHA256dcd26dd5137208abdfe22a81c0d97037c62aff59202db4e8328266a4b46ba2eb
SHA512e9a72842284abd51b10df2a9c0ba38cd45704e4bc025c5e8c84c4e8afa98f164e7d051b113b35a8b3a691ad424557ea4074a827c18465ab01bded54abe22eb62
-
Filesize
19KB
MD5c681ce55db1faf84ee05e7b2ab3b6ed1
SHA1aedd0a0c47602984ee3123a8e765ce847f5cff15
SHA256b9fb517638bf7fed24177a16015e447527475531463f5a3c2a8e71224ed4d75a
SHA512f45b4deb290bba6edbfd56d898adf164ae17af4284daae98c4d02b202acd9d2fb3eaf2d87544e912aa43c8f7b11fc176043bd243e5059612cf2287a14e97de6a
-
Filesize
1.9MB
MD5e8b23d814e7b74a68f52f141abdbcd95
SHA17bf0de3de89e3b4102a247461e1c679fe57f9ffe
SHA256522e259c0ecb85fe8f2432f594f2868e6fb24b79415edeec52096221c4cf6ec1
SHA5125d0ffd7acd4b56167002bfcc9ed7ce4ba95ef032fbf7306f56c029f8230016f5bb918eecc31bf3659c3c2a857631203d939f9e2d8ca821f8f247121c190715bf
-
Filesize
194KB
MD502d615171b805cc573b28e17611f663f
SHA12e63b78316b4eae6ee1c25f1f10fbbb84ecef054
SHA256e60b5cbdf7480db1fc829e05ce45703d43d5ba25fdf7fba21cca1d38b1f3b3a4
SHA512b61cd3d16d1a192016a50342ae71fee8f764c4c156e275a320f74cc4ec65755c91c022231d09a76b59d6225960f5a930f1887003b1d6984beeb5a9648b045427
-
Filesize
1.9MB
MD5382e02600c7062118849b905ddd422ee
SHA1f60543145bcd93d35c2d37a56e06f2a244e27641
SHA256103566fe0cdc6b4d24b38f1f086f1034a9eaaf458b5f5bcd3b3e7285a0ba5e3c
SHA512a6d94cb161659f8aed20d6127197e268f88d96358d29b4d42c14ec32d6d2f7730b2d00c2272149d9f60506fe2eb5fb6403ccc232a8000657a7fbb5d6a96edbcf
-
Filesize
26KB
MD539b7c056bca546778690b9922315f9ff
SHA15f62169c8de1f72db601d30b37d157478723859b
SHA2569514b4c40c35396b1952a8acf805e993a3875b37370f44ef36ed33c7151412ef
SHA512229538131d83299ea90652818c99972c1ee692c070e7fea9599420c99dd8ae75fb2367e9509aad23984fe0a8d21221a59bd57493b5cd1d6c7391c3c55d714e94