Overview

overview

10

Static

static

10

2024-04-26...ms.exe

windows7-x64

9

2024-04-26...ms.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe

  • Size

    16.8MB

  • MD5

    2696a373b015b79ec0ba62077a4cabe6

  • SHA1

    34d8eb5774b3d3af8be8e1c1e7e353aff78967ef

  • SHA256

    394ad860cbc9d532803049e2c72abf62ddc613d681c0440b156291c6b5c4e6b5

  • SHA512

    9aaa7cc100d721dde2b137a81efdfbde69faf6df384922e31ad2b526495dd16cb5ce57a9f930b363432e02e76b0b6f41945d298722e6923a7bcde0a67c927cf2

  • SSDEEP

    196608:sKx4vtup77rruuPwJrEvB8H42LYy/19kjJITyOy/19J:sKx4vFu4rE58H48LbeVL

Score
9/10

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables packed with ConfuserEx Custom; outside of GIT 3 IoCs
  • Detects executables packed with or use KoiVM 3 IoCs
  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\d.dll
    Filesize

    121KB

    MD5

    25c0ad929078001a9abce07d5636e4b0

    SHA1

    2e52ad5b998334ada21b099a861ecc748fa68182

    SHA256

    58d9b84f39db8e009d347b360b0165db1cef8f75ab56a82084487864791ed9cb

    SHA512

    0841826dd4f0f18eb42415f529963ac02752a7f8593f21f07c1af411bd76de1f70865fcc5415e60623c2edbf34610c09a9e6ec16c29c84666ed1336a47b91fbc

    Download Submit

  • memory/2088-0-0x00000000747C0000-0x0000000074EAE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2088-1-0x0000000000990000-0x0000000001A70000-memory.dmp

    Filesize

    16.9MB

    Download

  • memory/2088-2-0x0000000000230000-0x0000000000262000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2088-3-0x0000000005B70000-0x0000000005BB0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2088-9-0x0000000000CAA000-0x0000000000CAB000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2088-10-0x0000000005B70000-0x0000000005BB0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2088-12-0x00000000747C0000-0x0000000074EAE000-memory.dmp

    Filesize

    6.9MB

    Download