Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 14:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XqeosvmvOM.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
XqeosvmvOM.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
XqeosvmvOM.exe
-
Size
22.8MB
-
MD5
257afe5adb6d820914820f2f34263dc8
-
SHA1
ab292842fee5e5031ed0d04140b624b81be1ee8e
-
SHA256
1bc4b52e734e78fd92042ff55f58c03735b7fff3eb7bfed5611655d71654a25d
-
SHA512
02b1cd08fce41fc59f177f555665551cd8726c679f6a9097a62e929a6a22e15296bdc8b6b7a0712aa635e9b503e236c8f323bfbaefc81e3310e2f773374de52f
-
SSDEEP
393216:gvctGrxsatYfdIEy7mdFawPxZa+HeMqAuRV5ijdHeqr8r6RbYLL/wXvnrlDGnz:gggxMfdIP7mOwbxVQV4dz8r6RbIL/wXm
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 39 IoCs
pid Process 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe -
Kills process with taskkill 1 IoCs
pid Process 2708 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe 2872 XqeosvmvOM.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2708 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2808 2872 XqeosvmvOM.exe 28 PID 2872 wrote to memory of 2808 2872 XqeosvmvOM.exe 28 PID 2872 wrote to memory of 2808 2872 XqeosvmvOM.exe 28 PID 2808 wrote to memory of 2708 2808 cmd.exe 30 PID 2808 wrote to memory of 2708 2808 cmd.exe 30 PID 2808 wrote to memory of 2708 2808 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\XqeosvmvOM.exe"C:\Users\Admin\AppData\Local\Temp\XqeosvmvOM.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-