Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe
Resource
win10v2004-20240226-en
General
-
Target
4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe
-
Size
703KB
-
MD5
2fa628c2aa39d0812a97ad6837d69512
-
SHA1
b9ddecb08cff1acbb33f04b1c034e336444bbc90
-
SHA256
4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202
-
SHA512
9795d3a436ebada89387064b775237fd200be4a01f43faa96e0951d20a96ccd17ab8a9988f4799cb774226fa5150472326495842cf6f36d362e2a296133744a6
-
SSDEEP
192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1028 4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe