Overview
overview
7Static
static
78bb7b885c7...0N.exe
windows7-x64
38bb7b885c7...0N.exe
windows10-2004-x64
3$EXEFILE.exe
windows7-x64
4$EXEFILE.exe
windows10-2004-x64
4$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3wget.exe
windows7-x64
7wget.exe
windows10-2004-x64
7Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:30
Behavioral task
behavioral1
Sample
8bb7b885c78805311c660c5fe5097730N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8bb7b885c78805311c660c5fe5097730N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$EXEFILE.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$EXEFILE.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
wget.exe
Resource
win7-20240903-en
General
-
Target
$EXEFILE.exe
-
Size
244KB
-
MD5
baef4b564ae6b51a4c5bdcc73fa87b47
-
SHA1
f0096a378875576c8a64530f3c8d7ba2f107c935
-
SHA256
966863ab8106ee72a1bc7b425b85501564f95599ad612db642ad081e5fe82100
-
SHA512
e554e0ecab8ffacea55b4e689af78843c437c50c0d91c4f6c1dfeb450367a5740587486b355ccf4213fb9af835a2e436aa4d06b63b4b174966860bee9d05be50
-
SSDEEP
3072:1l/72Bf4+RDnLLrgLDqUHNY8M2cKd+P7249U0/Yf7IN1Ytl7q:Xz2BACDvYr7MHKd+P7249U+E7Kq
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new $EXEFILE.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new $EXEFILE.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2328 $EXEFILE.exe Token: 33 2328 $EXEFILE.exe Token: SeIncBasePriorityPrivilege 2328 $EXEFILE.exe Token: 33 2328 $EXEFILE.exe Token: SeIncBasePriorityPrivilege 2328 $EXEFILE.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2328 $EXEFILE.exe 2328 $EXEFILE.exe