Analysis
-
max time kernel
62s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
26/04/2024, 23:42
General
-
Target
2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe
-
Size
16.8MB
-
MD5
2696a373b015b79ec0ba62077a4cabe6
-
SHA1
34d8eb5774b3d3af8be8e1c1e7e353aff78967ef
-
SHA256
394ad860cbc9d532803049e2c72abf62ddc613d681c0440b156291c6b5c4e6b5
-
SHA512
9aaa7cc100d721dde2b137a81efdfbde69faf6df384922e31ad2b526495dd16cb5ce57a9f930b363432e02e76b0b6f41945d298722e6923a7bcde0a67c927cf2
-
SSDEEP
196608:sKx4vtup77rruuPwJrEvB8H42LYy/19kjJITyOy/19J:sKx4vFu4rE58H48LbeVL
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
-
Detects executables packed with ConfuserEx Custom; outside of GIT 2 IoCs
-
Detects executables packed with or use KoiVM 2 IoCs
-
Detects executables referencing many IR and analysis tools 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_2696a373b015b79ec0ba62077a4cabe6_elex_lightbolt_mafia_skypams.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 10842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1320 -ip 13201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD525c0ad929078001a9abce07d5636e4b0
SHA12e52ad5b998334ada21b099a861ecc748fa68182
SHA25658d9b84f39db8e009d347b360b0165db1cef8f75ab56a82084487864791ed9cb
SHA5120841826dd4f0f18eb42415f529963ac02752a7f8593f21f07c1af411bd76de1f70865fcc5415e60623c2edbf34610c09a9e6ec16c29c84666ed1336a47b91fbc
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
16.9MB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB