Analysis
-
max time kernel
99s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20241023-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
3.9MB
-
MD5
47a3da93e56b32634ef75d89326eddfd
-
SHA1
c713ae03c5ca84d5b9d00c3766976a80ff4870f9
-
SHA256
9da77aa713f1d8a0c0491326e6b187f57c59a9ac9988765913ad837b59dd0687
-
SHA512
94a936ed621f8aee938bd9e58827723243519c282591d00713f5825c465d2e68b8598911bba712d1a62795d380e4c19b04449a4333983484b03f051fdad18ad6
-
SSDEEP
98304:Nk1zJMJNrH1Z236EYzNVGm+xI7jfg/7KlTrzTGnI4A/z1Vre:q1zJSVHD236JXjY/7KFKnCz1Ze
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Loader.exedescription pid Process Token: SeDebugPrivilege 3600 Loader.exe