Analysis

  • max time kernel
    132s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 01:43

General

  • Target

    50edf90f267e5c9693958f5c1c9e45e64c000300eccccaf3e7f583f757bd54b1.exe

  • Size

    368KB

  • MD5

    d5a1d2a19ae94de023e3684a17afb67a

  • SHA1

    44ab6df7d83db46650467af74e27a3098bf4e60c

  • SHA256

    50edf90f267e5c9693958f5c1c9e45e64c000300eccccaf3e7f583f757bd54b1

  • SHA512

    f5d3fe49b20fc8621dada63e0b82f7af1626a15bc710e48acc52f4fa878e0bb86c3daa77e1e3ceb4f1b6e8f5bf1e4a43fdaf7d0138991a03fa0fae9ee19bb7fd

  • SSDEEP

    192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50edf90f267e5c9693958f5c1c9e45e64c000300eccccaf3e7f583f757bd54b1.exe
    "C:\Users\Admin\AppData\Local\Temp\50edf90f267e5c9693958f5c1c9e45e64c000300eccccaf3e7f583f757bd54b1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4872-0-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

    Filesize

    4KB

  • memory/4872-1-0x0000000000080000-0x000000000008A000-memory.dmp

    Filesize

    40KB

  • memory/4872-2-0x0000000004A50000-0x0000000004AE2000-memory.dmp

    Filesize

    584KB

  • memory/4872-3-0x0000000074C80000-0x0000000075430000-memory.dmp

    Filesize

    7.7MB

  • memory/4872-4-0x00000000052E0000-0x0000000005884000-memory.dmp

    Filesize

    5.6MB

  • memory/4872-5-0x0000000005A00000-0x0000000005A66000-memory.dmp

    Filesize

    408KB

  • memory/4872-6-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

    Filesize

    4KB

  • memory/4872-7-0x0000000074C80000-0x0000000075430000-memory.dmp

    Filesize

    7.7MB