Overview
overview
7Static
static
7YENI_HILE_...SK.rar
windows7-x64
3YENI_HILE_...SK.rar
windows10-2004-x64
3YENİ HİL...v3.exe
windows7-x64
6YENİ HİL...v3.exe
windows10-2004-x64
6YENİ HİL...V3.dll
windows7-x64
3YENİ HİL...V3.dll
windows10-2004-x64
3YENİ HİL...hl.exe
windows7-x64
7YENİ HİL...hl.exe
windows10-2004-x64
7out.exe
windows7-x64
3out.exe
windows10-2004-x64
3YENİ HİL...v3.dll
windows7-x64
3YENİ HİL...v3.dll
windows10-2004-x64
3YENİ HİL...v3.ini
windows7-x64
1YENİ HİL...v3.ini
windows10-2004-x64
1YENİ HİL...hd.ini
windows7-x64
1YENİ HİL...hd.ini
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 15:39
Behavioral task
behavioral1
Sample
YENI_HILE_THE_MASK.rar
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
YENI_HILE_THE_MASK.rar
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
YENİ HİLE/Extreme Injector v3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
YENİ HİLE/Extreme Injector v3.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
YENİ HİLE/ZeroV3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
YENİ HİLE/ZeroV3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
YENİ HİLE/ZeroV3.hl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
YENİ HİLE/ZeroV3.hl.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
out.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
out.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
YENİ HİLE/Zerov3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
YENİ HİLE/Zerov3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
YENİ HİLE/Zerov3.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
YENİ HİLE/Zerov3.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
YENİ HİLE/injmthd.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
YENİ HİLE/injmthd.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
YENİ HİLE/Extreme Injector v3.exe
-
Size
1.9MB
-
MD5
ec801a7d4b72a288ec6c207bb9ff0131
-
SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561
-
SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
-
SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
-
SSDEEP
49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 raw.githubusercontent.com 3 raw.githubusercontent.com -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: SeDebugPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe Token: 33 2640 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 2640 Extreme Injector v3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2744 2640 Extreme Injector v3.exe 30 PID 2640 wrote to memory of 2744 2640 Extreme Injector v3.exe 30 PID 2640 wrote to memory of 2744 2640 Extreme Injector v3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\YENİ HİLE\Extreme Injector v3.exe"C:\Users\Admin\AppData\Local\Temp\YENİ HİLE\Extreme Injector v3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2640 -s 7322⤵PID:2744
-