Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
bin/api/CeleryIn.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
bin/api/CeleryIn.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
bin/api/CeleryInject.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
bin/api/CeleryInject.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ccapi.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
ccapi.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
General
-
Target
bin/api/CeleryIn.dll
-
Size
44KB
-
MD5
2ff4c3eab9fa5c1b80809309d7a0e0c2
-
SHA1
50897c4c104f3c487e1c66da2c78f248f367d80c
-
SHA256
a438813697cb96dc60daf799954f46f9ba46f35d0cf2e1412514a798dcd23e60
-
SHA512
56d11d106add285c859086740117cfd895cc86e2c1633efcc56215ea8cc9cbcb21daeefe71dd906f4ce334d9087b2e6e11fc0a3c1f1e453c59e23ad10e5345b2
-
SSDEEP
384:mVdzew6q0MEe7Tc8cZO1D9WDPAU7cRUSoTYVJa53oVMmA2QdwB5bh1r:cYiXFcZkRcpJTYVJa8NA2jj
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2752 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\api\CeleryIn.dll,#11⤵PID:2072
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1284
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2752