3de43ae3db6b73cab9c9e0eae4df075e053a86f6a1ded79e175557fab7e0f0d8 | Triage

Analysis

max time kernel
1800s
max time network
1502s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
13/05/2024, 19:27

Sharing

Report Analysis Logs

General

Target

Release/CeleryInject.exe
Size

3.1MB
MD5

66e53760e7696b7499b96a833cf95b5b
SHA1

894ad4c70c5ac238aa9197457dded6480e6c5bb4
SHA256

ae1cef5a183c95cbd22d169f67ff066a362ed4a460b581eaf03fcf70b803cbf0
SHA512

32b167c46e1ce35dbfd3571a1fcdc332c3cfa7a875dbeb4c6d412615feef4a29dd3c4944dd89542889ab4dfa922d802a690219092113ab7e75d452b11d2abaa4
SSDEEP

24576:fDitqK9+8di9xpry900xpUthUTGhZczfAQQpDtPDGjP8YcRhpp3fGGQ2AuGYP8:fWtr7i/Q903HDhZPhDGjP8lRDp3fNAu

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe
4632	CeleryInject.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	CeleryInject.exe

C:\Users\Admin\AppData\Local\Temp\Release\CeleryInject.exe
"C:\Users\Admin\AppData\Local\Temp\Release\CeleryInject.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads