089b9af9ccab56dc15339777ed6435b0aa9d12f1f50481a5342dbd61c4264da5 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 06:39

Sharing

Report Analysis Logs

General

Target

LGBeanDl.exe
Size

431KB
MD5

1e65942eaadf527f0ac7b5da80f2bb19
SHA1

6311e591a6432c511a4b92c81e6c52a99891c0a3
SHA256

54ea93e836e100a7b247e3e445eeb020d626ac67dbef096d5fd82bb498dc04c4
SHA512

a1349aa03b83036177c25450eba30a77672464af8012ab51ef2e82d1904bbcb8abd44cc2cab1fa33328ccd9c4035d62499e358ec66b48af37e357aaf9f1dec2e
SSDEEP

6144:d725bOomPhTzyz8LJ9JJzNNymg/w4NoSTkYQPLAxj3sOuOKN7vjPZ5PXW:NsmZLJPR5AkYQPExj3sO7KN7vDXW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	LGBeanDl.exe
Token: SeShutdownPrivilege	3024	LGBeanDl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	LGBeanDl.exe
3024	LGBeanDl.exe

C:\Users\Admin\AppData\Local\Temp\LGBeanDl.exe
"C:\Users\Admin\AppData\Local\Temp\LGBeanDl.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads