06791c5065dc65368438a6422fe4c8ba3d134333db1ea45ded28138f6702f242

Analysis

max time kernel
450s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ExtremeDarkAkuma/EXDHardP1.bat
Size

786B
MD5

df0ef87db0256a51be2e6b264def818e
SHA1

15092073af2d8702e702f0c230388717e87f8fff
SHA256

602e91ef447a88e662ed91d5f14480c8bbc095da3a855f248ca9a0c2b76f8dc4
SHA512

24ac0ee42b0e369b16f7ed50ac0ad127ef516c1e7691c694b5c398c816678338a1d026fc447021cc480a8ba9f613a305b31c4afd344ac32711cbc8d700c987da

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 14 IoCs

evasion

pid	Process
3996	taskkill.exe
4640	taskkill.exe
1420	taskkill.exe
2244	taskkill.exe
4356	taskkill.exe
4292	taskkill.exe
4024	taskkill.exe
3828	taskkill.exe
1448	taskkill.exe
4788	taskkill.exe
2480	taskkill.exe
3960	taskkill.exe
1916	taskkill.exe
4248	taskkill.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3828	3580	cmd.exe	82
PID 3580 wrote to memory of 3828	3580	cmd.exe	82
PID 3580 wrote to memory of 4788	3580	cmd.exe	84
PID 3580 wrote to memory of 4788	3580	cmd.exe	84
PID 3580 wrote to memory of 3996	3580	cmd.exe	85
PID 3580 wrote to memory of 3996	3580	cmd.exe	85
PID 3580 wrote to memory of 4640	3580	cmd.exe	86
PID 3580 wrote to memory of 4640	3580	cmd.exe	86
PID 3580 wrote to memory of 1916	3580	cmd.exe	87
PID 3580 wrote to memory of 1916	3580	cmd.exe	87
PID 3580 wrote to memory of 1420	3580	cmd.exe	88
PID 3580 wrote to memory of 1420	3580	cmd.exe	88
PID 3580 wrote to memory of 2244	3580	cmd.exe	89
PID 3580 wrote to memory of 2244	3580	cmd.exe	89
PID 3580 wrote to memory of 4356	3580	cmd.exe	90
PID 3580 wrote to memory of 4356	3580	cmd.exe	90
PID 3580 wrote to memory of 2480	3580	cmd.exe	91
PID 3580 wrote to memory of 2480	3580	cmd.exe	91
PID 3580 wrote to memory of 4292	3580	cmd.exe	92
PID 3580 wrote to memory of 4292	3580	cmd.exe	92
PID 3580 wrote to memory of 4024	3580	cmd.exe	93
PID 3580 wrote to memory of 4024	3580	cmd.exe	93
PID 3580 wrote to memory of 1448	3580	cmd.exe	94
PID 3580 wrote to memory of 1448	3580	cmd.exe	94
PID 3580 wrote to memory of 4248	3580	cmd.exe	95
PID 3580 wrote to memory of 4248	3580	cmd.exe	95
PID 3580 wrote to memory of 3960	3580	cmd.exe	96
PID 3580 wrote to memory of 3960	3580	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDarkAkuma\EXDHardP1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Dark_Donald_4th-ICE_Hard.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Ancient_Magaki-2nd.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Ancient Magaki-2nd.bat*
  2⤵
  - Kills process with taskkill
  PID:3996
- C:\Windows\system32\taskkill.exe
  taskkill -f -im phantom.exe*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\taskkill.exe
  taskkill -f -im p1_Main.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\system32\taskkill.exe
  taskkill -f -im p2_Main.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Resolute_P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Resolute_P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\system32\taskkill.exe
  taskkill -f -im ;Main_Program.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\system32\taskkill.exe
  taskkill -f -im Phantom.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\system32\taskkill.exe
  taskkill -f -im P1.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\system32\taskkill.exe
  taskkill -f -im P2.bat*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3960

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads