Analysis
-
max time kernel
61s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/08/2024, 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CeleryInject.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
General
-
Target
CeleryInject.exe
-
Size
5.5MB
-
MD5
072bd8b0166f4e8c134fddd1a91b16c6
-
SHA1
da0e078b22b6739eb2ae67ef3dd7ac7ee841f96c
-
SHA256
f84e39b3be2ba74691b82dab25a4d42d13535f138d9c69ffe37d45d90612a34f
-
SHA512
5ff3173c47a7718c41076507a5c3d8e83021928dead3c82ce6e46b4609afa6ffa4af7cd4af1b779805c00ccd5b9ee5a59144c0507bb17db8fad77b0e144ee828
-
SSDEEP
49152:uACTPFe76hHoYwVbV+huHplzrvTAm+DGjV1ykc+nPsbn3+nM6Pzs0dn3dnndn+dF:WwHpoe6
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe 1296 CeleryInject.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe"C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:884