b6891040f602f8ac1ab00c25ce1ca33d363e5ad6ace3ce21fed10e19ab097d5c | Triage

Analysis

max time kernel
442s
max time network
366s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LiveBot.exe
Size

154.6MB
MD5

3f94448c522b1b909437a273eba1068d
SHA1

2a8711b276dc842f93a6b0cd739ee79843890dd7
SHA256

b6891040f602f8ac1ab00c25ce1ca33d363e5ad6ace3ce21fed10e19ab097d5c
SHA512

6e9f5c7821c88a60cda3e89a54fa927d0ab8d92de3665c8c662611f8135ffc4c7ed139a91b8d26d39e44cf6a0e67195fc6de0a857f8ddc8b61c40fd2d86a3d10
SSDEEP

1572864:4eBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapv:LMRZlrn3H

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1900	AUDIODG.EXE
Token: 33	1900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1900	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\LiveBot.exe
"C:\Users\Admin\AppData\Local\Temp\LiveBot.exe"
1⤵
PID:2552

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads