6f18e0dd21bb635d5b36c14b744d7222f02598dbc7adc12ddf6178a30ce9b265 | Triage

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 05:08

Sharing

Report Analysis Logs

General

Target

Xulace.exe
Size

16.3MB
MD5

7667328084d8862b561992a8ce4f0972
SHA1

994db1d548d87a1a008a35bb067a46c03d429a34
SHA256

6f18e0dd21bb635d5b36c14b744d7222f02598dbc7adc12ddf6178a30ce9b265
SHA512

0964129b33c211654eaeec047c44854acf6a39b70e6efae6c21210871b1f7eca8ea88c69419db7fa9ae96115aaa8d97f9797241f1ff4e1aed1f7363f7179918f
SSDEEP

393216:oGKoYuClnhnIFRRdx9X0OAMroSdabRxeqBOh4:oGIhnazX0OA+oSdwRxeqBOh4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1068-0-0x0000000140000000-0x0000000141054000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2464	AUDIODG.EXE
Token: 33	2464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2464	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Xulace.exe
"C:\Users\Admin\AppData\Local\Temp\Xulace.exe"
1⤵
PID:1068

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-0-0x0000000140000000-0x0000000141054000-memory.dmp

Filesize
16.3MB

Download