Analysis
-
max time kernel
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-08-2024 16:18
Behavioral task
behavioral1
Sample
S3M.exe
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
150 seconds
General
-
Target
S3M.exe
-
Size
50.9MB
-
MD5
60343d91b173d06833f4b140e350402e
-
SHA1
f860fd75d740a6e5fb8d60da3dc16937e59367c5
-
SHA256
edc045eca80f0ca41c2e4efd0e45867dc6d502b6eae18bdffb4fba96dcab1626
-
SHA512
6af0679af6375214fedb36a030784aa3333265910b5cb7d2b466ee54f7442050d5ce572bbd85849627777bb7c5107280a6edbba29f4aea2f8578b88f6f52279f
-
SSDEEP
786432:vQQQQQQQQQQQQQQQbQQQQQQQQQQQQQQQqQQQQQQQ:vhhhhhhhehhhhhhhXhhh
Score
10/10
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe 4472 S3M.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4472 S3M.exe