Overview
overview
10Static
static
3Loader.exe
windows7-x64
7Loader.exe
windows10-2004-x64
10diaguard.dll
windows7-x64
1diaguard.dll
windows10-2004-x64
1msys-2.0.dll
windows7-x64
7msys-2.0.dll
windows10-2004-x64
10tmpD01A.dll
windows7-x64
1tmpD01A.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1winAPI.exe
windows7-x64
7winAPI.exe
windows10-2004-x64
10Analysis
- max time kernel
93s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/08/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
diaguard.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
diaguard.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
msys-2.0.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
msys-2.0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
tmpD01A.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
tmpD01A.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
vcruntime140.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
vcruntime140.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
winAPI.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
winAPI.exe
Resource
win10v2004-20240802-en
General
- Target tmpD01A.dll
- Size 3.5MB
- Sample240805-nmcstsvdmr
- SHA256 709f39277a3393fbdb4349bb19b80e2d976dd8926d6fcbe0e59d699338846016
- MD5 1a201cec87e2370a08dc00acc065501a
- SHA1 02ff14bbb59d380cc8e7ffea711d978248bfcb83
- SHA512 e80e75a672807dfa1da6002bb02e8024eaadb75f79f22c40c72c82c213d99b3f4dcdeb963a7587c0a5532fa8b6c53e9ac6eb512fc422d654191215e266eef1e1
- SSDEEP 98304:UMoiKk/w5lfGCSlKNS48Rzp3roT91u7MHLzV0ZghXVp2vGmB:8iKk/9CSlKNvq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1092 rundll32.exe Token: SeBackupPrivilege 1092 rundll32.exe Token: SeDebugPrivilege 1092 rundll32.exe