06791c5065dc65368438a6422fe4c8ba3d134333db1ea45ded28138f6702f242

Analysis

max time kernel
1737s
max time network
1167s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExtremeDarkAkuma/EXDGoukiP1.bat
Size

979B
MD5

5e12b1454c40a8f14b0df54c557acb69
SHA1

f2811cb3eb0c527b63f5089c435d8d089b3cd42c
SHA256

07b21fa33ccacf90d12c5f9459f29245d9f620eae03af7d6f484dbd24655a1fc
SHA512

8f7db8d60269f02ededbae4f94b4c24557d0d273a188d607bde2ddda509604c5bdeae6f300d2d159c01190e7eaf34e97fe94d62e946eb105ef458084459fb7c6

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 16 IoCs

evasion

pid	Process
4468	taskkill.exe
3740	taskkill.exe
724	taskkill.exe
4168	taskkill.exe
2908	taskkill.exe
768	taskkill.exe
2992	taskkill.exe
2560	taskkill.exe
2292	taskkill.exe
3464	taskkill.exe
2760	taskkill.exe
3568	taskkill.exe
4160	taskkill.exe
2928	taskkill.exe
1808	taskkill.exe
1760	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3464	2960	cmd.exe	85
PID 2960 wrote to memory of 3464	2960	cmd.exe	85
PID 2960 wrote to memory of 2760	2960	cmd.exe	87
PID 2960 wrote to memory of 2760	2960	cmd.exe	87
PID 2960 wrote to memory of 724	2960	cmd.exe	89
PID 2960 wrote to memory of 724	2960	cmd.exe	89
PID 2960 wrote to memory of 4168	2960	cmd.exe	90
PID 2960 wrote to memory of 4168	2960	cmd.exe	90
PID 2960 wrote to memory of 2908	2960	cmd.exe	91
PID 2960 wrote to memory of 2908	2960	cmd.exe	91
PID 2960 wrote to memory of 3568	2960	cmd.exe	92
PID 2960 wrote to memory of 3568	2960	cmd.exe	92
PID 2960 wrote to memory of 4160	2960	cmd.exe	93
PID 2960 wrote to memory of 4160	2960	cmd.exe	93
PID 2960 wrote to memory of 768	2960	cmd.exe	94
PID 2960 wrote to memory of 768	2960	cmd.exe	94
PID 2960 wrote to memory of 2928	2960	cmd.exe	95
PID 2960 wrote to memory of 2928	2960	cmd.exe	95
PID 2960 wrote to memory of 2992	2960	cmd.exe	97
PID 2960 wrote to memory of 2992	2960	cmd.exe	97
PID 2960 wrote to memory of 4468	2960	cmd.exe	98
PID 2960 wrote to memory of 4468	2960	cmd.exe	98
PID 2960 wrote to memory of 1808	2960	cmd.exe	99
PID 2960 wrote to memory of 1808	2960	cmd.exe	99
PID 2960 wrote to memory of 2560	2960	cmd.exe	100
PID 2960 wrote to memory of 2560	2960	cmd.exe	100
PID 2960 wrote to memory of 3740	2960	cmd.exe	101
PID 2960 wrote to memory of 3740	2960	cmd.exe	101
PID 2960 wrote to memory of 1760	2960	cmd.exe	102
PID 2960 wrote to memory of 1760	2960	cmd.exe	102
PID 2960 wrote to memory of 2292	2960	cmd.exe	103
PID 2960 wrote to memory of 2292	2960	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDarkAkuma\EXDGoukiP1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Dark_Donald_4th-ICE_Hard.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Ancient_Magaki-2nd.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Ancient Magaki-2nd.bat*
  2⤵
  - Kills process with taskkill
  PID:724
- C:\Windows\system32\taskkill.exe
  taskkill -f -im phantom.exe*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\system32\taskkill.exe
  taskkill -f -im p1_Main.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\taskkill.exe
  taskkill -f -im p2_Main.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Resolute_P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Resolute_P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_Program.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Phantom.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\system32\taskkill.exe
  taskkill -f -im P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  taskkill -f -im P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\system32\taskkill.exe
  taskkill -f -im 32.exe*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\taskkill.exe
  taskkill -f -im 64.exe*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2292

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads