438feda938832df90130f43270eaa7d8c6072c14a88c1ae9bf02e7869fcc3d19 | Triage

Resubmissions

12/05/2024, 11:35

240512-nqc8rsdb4v 3

Analysis

max time kernel
150s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 11:35

Sharing

Report Analysis Logs

General

Target

Release/CeleryInject.exe
Size

3.1MB
MD5

87d4963332c48cbf50bead6cf810c7ec
SHA1

87a7262ae85b27c013c2289a0d52b1a02d4d7222
SHA256

2c00feddea40141c010b8df4408742694960da39411b49a9e49c165e52d41aa0
SHA512

774f6607828435dbe7d04db0d4ea9099a886d91846e1d4d26e110ee462ac243345ed0a1737ef63c09342c2dae0bbe1862cce2644e2fab67f8cf2ca47cf263efc
SSDEEP

49152:JbCT2pnX/Q2uteYg/c+NDGjP8lRSp3fvid:w2uy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe
1428	CeleryInject.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	CeleryInject.exe

C:\Users\Admin\AppData\Local\Temp\Release\CeleryInject.exe
"C:\Users\Admin\AppData\Local\Temp\Release\CeleryInject.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads