d03c4bd3d2392477a6ae2641026304f57f5dded4c78d5177042cbddf3ab702b0

Analysis

max time kernel
149s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 22:57

Target

AK.xolotl.v1.3.13502/AK.xolotl.v1.3.13502/ak-xolotl.exe
Size

651KB
MD5

91516651cac9d478be48acde50e454b1
SHA1

5cfab6c4e0b3df2255bf73c72e8d4e3ee6aa8648
SHA256

01910e9e1cb086e5e40c9815479c41cf5c25ad944d9666d9e3b4dbf5b2e29a13
SHA512

0802c57ca610b54b9fbb66b2ed923f2658d827d5842f4498d2ace5e98619f9c1f562a6a6c40b60af94f2c3b6041f62d11b96d58e3005433fb30e580a27adc3b4
SSDEEP

3072:PQJ/VdFgIW9mYucJ/OD8JlsI9FTIK8dRjMkjCjCoKEU2A1d28a:8/7FG9mpcJ/OD8sKwopf

Score

1^/10

Modifies registry class 1 IoCs

Processes:

ak-xolotl.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2990742725-2267136959-192470804-1000\{7663CD8F-98A5-4151-AA15-4DC1E2FB73AE}	ak-xolotl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ak-xolotl.exe

pid process

792 ak-xolotl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4848 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4848 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ak-xolotl.exe

pid process

792 ak-xolotl.exe
792 ak-xolotl.exe

pid	process
792	ak-xolotl.exe

description	pid	process
Token: 33	4848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4848	AUDIODG.EXE

pid	process
792	ak-xolotl.exe
792	ak-xolotl.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ak-xolotl.exe

description	pid	process	target process
PID 792 wrote to memory of 1724	792	ak-xolotl.exe	UnityCrashHandler64.exe
PID 792 wrote to memory of 1724	792	ak-xolotl.exe	UnityCrashHandler64.exe

C:\Users\Admin\AppData\Local\Temp\AK.xolotl.v1.3.13502\AK.xolotl.v1.3.13502\UnityCrashHandler64.exe
"C:\Users\Admin\AppData\Local\Temp\AK.xolotl.v1.3.13502\AK.xolotl.v1.3.13502\UnityCrashHandler64.exe" --attach 792 2058360655872
2⤵
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848

memory/792-0-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download
memory/792-9-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download
memory/792-8-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download
memory/792-5-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download
memory/792-12-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download
memory/792-11-0x00007FFA5DF90000-0x00007FFA5DFA0000-memory.dmp

Filesize
64KB

Download