Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
a25417c2f39f55cd8dd829095828889a93a0c55b38c4de80765414733741d470.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a25417c2f39f55cd8dd829095828889a93a0c55b38c4de80765414733741d470.exe
Resource
win10v2004-20240426-en
General
-
Target
a25417c2f39f55cd8dd829095828889a93a0c55b38c4de80765414733741d470.exe
-
Size
489KB
-
MD5
a714847629f538acbc3994987b619a38
-
SHA1
fd325eab1636936d84e6fe19af22960ecb8934f6
-
SHA256
a25417c2f39f55cd8dd829095828889a93a0c55b38c4de80765414733741d470
-
SHA512
6ef24a458827192dac6395b0ccbc527ab29728302f313a223fdb0d2cd1198d3440b0cdb3feabea5237335c9e113d8a508e2f2dbfc167a38f3408236824825f98
-
SSDEEP
192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2928 a25417c2f39f55cd8dd829095828889a93a0c55b38c4de80765414733741d470.exe