Analysis
- max time kernel
148s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Alidebug.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Alidebug.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Alidebug.exe
- Size 4.9MB
- Sample240613-m26tsawbla
- SHA256 d3f6c9db73f36dafd4267c808b4e89cf078ac2b5c345fb9b6b5e3d9094067101
- MD5 8792b68ee80d0d6c8de84408cfa853e8
- SHA1 b7c2ffca7d03bbc56626726b7f3db6b97412ca8e
- SHA512 c756572dd3b2e31d2205ab05faef8b4e44225d151fbd8217aa2bcebfaf5e3f4ffa2c4fcd5896b399b4624d2ffc2ff87aa475001a3e1501d78ccfd4b9346e3282
- SSDEEP 49152:qf+U8iSK9WQqyCKgFlrvMsv8fAqOOEJ1HY8L4havKqiE8/K4Q9EWhJ6I6Xd7UNqT:qf+U/UZdtvzv8zEJq+F8/2L6z
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 736 netsh.exe - Enumerates processes with tasklist 1 TTPs 32 IoCs
pid Process 4644 tasklist.exe 2504 tasklist.exe 4252 tasklist.exe 4460 tasklist.exe 3216 tasklist.exe 1640 tasklist.exe 4228 tasklist.exe 1120 tasklist.exe 5012 tasklist.exe 3644 tasklist.exe 5040 tasklist.exe 3720 tasklist.exe 4004 tasklist.exe 1984 tasklist.exe 640 tasklist.exe 3820 tasklist.exe 4876 tasklist.exe 1068 tasklist.exe 5088 tasklist.exe 2044 tasklist.exe 4276 tasklist.exe 3600 tasklist.exe 756 tasklist.exe 1384 tasklist.exe 228 tasklist.exe 764 tasklist.exe 2260 tasklist.exe 2232 tasklist.exe 1988 tasklist.exe 3276 tasklist.exe 4288 tasklist.exe 1232 tasklist.exe - Kills process with taskkill 2 IoCs
pid Process 4648 taskkill.exe 560 taskkill.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 4004 tasklist.exe Token: SeDebugPrivilege 4876 tasklist.exe Token: SeDebugPrivilege 228 tasklist.exe Token: SeDebugPrivilege 5012 tasklist.exe Token: SeDebugPrivilege 4648 taskkill.exe Token: SeDebugPrivilege 560 taskkill.exe Token: SeDebugPrivilege 4644 tasklist.exe Token: SeDebugPrivilege 1988 tasklist.exe Token: SeDebugPrivilege 2044 tasklist.exe Token: SeDebugPrivilege 1068 tasklist.exe Token: SeDebugPrivilege 4276 tasklist.exe Token: SeDebugPrivilege 3644 tasklist.exe Token: SeDebugPrivilege 3600 tasklist.exe Token: SeDebugPrivilege 3276 tasklist.exe Token: SeDebugPrivilege 4288 tasklist.exe Token: SeDebugPrivilege 1984 tasklist.exe Token: SeDebugPrivilege 764 tasklist.exe Token: SeDebugPrivilege 1232 tasklist.exe Token: SeDebugPrivilege 5088 tasklist.exe Token: SeDebugPrivilege 2504 tasklist.exe Token: SeDebugPrivilege 2260 tasklist.exe Token: SeDebugPrivilege 3216 tasklist.exe Token: SeDebugPrivilege 5040 tasklist.exe Token: SeDebugPrivilege 640 tasklist.exe Token: SeDebugPrivilege 4252 tasklist.exe Token: SeDebugPrivilege 2232 tasklist.exe Token: SeDebugPrivilege 756 tasklist.exe Token: SeDebugPrivilege 3820 tasklist.exe Token: SeDebugPrivilege 4460 tasklist.exe Token: SeDebugPrivilege 1640 tasklist.exe Token: SeDebugPrivilege 4228 tasklist.exe Token: SeDebugPrivilege 3720 tasklist.exe Token: SeDebugPrivilege 1384 tasklist.exe Token: SeDebugPrivilege 1120 tasklist.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4004 2520 Alidebug.exe 83 PID 2520 wrote to memory of 4004 2520 Alidebug.exe 83 PID 2520 wrote to memory of 4004 2520 Alidebug.exe 83 PID 2520 wrote to memory of 4876 2520 Alidebug.exe 82 PID 2520 wrote to memory of 4876 2520 Alidebug.exe 82 PID 2520 wrote to memory of 4876 2520 Alidebug.exe 82 PID 2520 wrote to memory of 228 2520 Alidebug.exe 87 PID 2520 wrote to memory of 228 2520 Alidebug.exe 87 PID 2520 wrote to memory of 228 2520 Alidebug.exe 87 PID 2520 wrote to memory of 5012 2520 Alidebug.exe 89 PID 2520 wrote to memory of 5012 2520 Alidebug.exe 89 PID 2520 wrote to memory of 5012 2520 Alidebug.exe 89 PID 2520 wrote to memory of 736 2520 Alidebug.exe 92 PID 2520 wrote to memory of 736 2520 Alidebug.exe 92 PID 2520 wrote to memory of 736 2520 Alidebug.exe 92 PID 2520 wrote to memory of 4648 2520 Alidebug.exe 96 PID 2520 wrote to memory of 4648 2520 Alidebug.exe 96 PID 2520 wrote to memory of 4648 2520 Alidebug.exe 96 PID 2520 wrote to memory of 560 2520 Alidebug.exe 98 PID 2520 wrote to memory of 560 2520 Alidebug.exe 98 PID 2520 wrote to memory of 560 2520 Alidebug.exe 98 PID 2520 wrote to memory of 4644 2520 Alidebug.exe 100 PID 2520 wrote to memory of 4644 2520 Alidebug.exe 100 PID 2520 wrote to memory of 4644 2520 Alidebug.exe 100 PID 2520 wrote to memory of 1988 2520 Alidebug.exe 102 PID 2520 wrote to memory of 1988 2520 Alidebug.exe 102 PID 2520 wrote to memory of 1988 2520 Alidebug.exe 102 PID 2520 wrote to memory of 2044 2520 Alidebug.exe 104 PID 2520 wrote to memory of 2044 2520 Alidebug.exe 104 PID 2520 wrote to memory of 2044 2520 Alidebug.exe 104 PID 2520 wrote to memory of 1068 2520 Alidebug.exe 106 PID 2520 wrote to memory of 1068 2520 Alidebug.exe 106 PID 2520 wrote to memory of 1068 2520 Alidebug.exe 106 PID 2520 wrote to memory of 4276 2520 Alidebug.exe 108 PID 2520 wrote to memory of 4276 2520 Alidebug.exe 108 PID 2520 wrote to memory of 4276 2520 Alidebug.exe 108 PID 2520 wrote to memory of 3644 2520 Alidebug.exe 111 PID 2520 wrote to memory of 3644 2520 Alidebug.exe 111 PID 2520 wrote to memory of 3644 2520 Alidebug.exe 111 PID 2520 wrote to memory of 3600 2520 Alidebug.exe 113 PID 2520 wrote to memory of 3600 2520 Alidebug.exe 113 PID 2520 wrote to memory of 3600 2520 Alidebug.exe 113 PID 2520 wrote to memory of 3276 2520 Alidebug.exe 115 PID 2520 wrote to memory of 3276 2520 Alidebug.exe 115 PID 2520 wrote to memory of 3276 2520 Alidebug.exe 115 PID 2520 wrote to memory of 4288 2520 Alidebug.exe 120 PID 2520 wrote to memory of 4288 2520 Alidebug.exe 120 PID 2520 wrote to memory of 4288 2520 Alidebug.exe 120 PID 2520 wrote to memory of 1984 2520 Alidebug.exe 124 PID 2520 wrote to memory of 1984 2520 Alidebug.exe 124 PID 2520 wrote to memory of 1984 2520 Alidebug.exe 124 PID 2520 wrote to memory of 764 2520 Alidebug.exe 126 PID 2520 wrote to memory of 764 2520 Alidebug.exe 126 PID 2520 wrote to memory of 764 2520 Alidebug.exe 126 PID 2520 wrote to memory of 1232 2520 Alidebug.exe 128 PID 2520 wrote to memory of 1232 2520 Alidebug.exe 128 PID 2520 wrote to memory of 1232 2520 Alidebug.exe 128 PID 2520 wrote to memory of 5088 2520 Alidebug.exe 130 PID 2520 wrote to memory of 5088 2520 Alidebug.exe 130 PID 2520 wrote to memory of 5088 2520 Alidebug.exe 130 PID 2520 wrote to memory of 2504 2520 Alidebug.exe 132 PID 2520 wrote to memory of 2504 2520 Alidebug.exe 132 PID 2520 wrote to memory of 2504 2520 Alidebug.exe 132 PID 2520 wrote to memory of 2260 2520 Alidebug.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\Alidebug.exe"C:\Users\Admin\AppData\Local\Temp\Alidebug.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq httpd.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq nginx.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq w3wp.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
PID:736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM httpd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ngnix.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1120
-