649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a

Submit
Reports

Overview

overview

Static

static

233f95c87f...31.exe

windows7-x64

233f95c87f...31.exe

windows10-2004-x64

2d8ea1230d...aa.exe

windows7-x64

2d8ea1230d...aa.exe

windows10-2004-x64

34dba85bb2...1a.exe

windows10-2004-x64

463d0b0903...ea.exe

windows7-x64

463d0b0903...ea.exe

windows10-2004-x64

4bcf45bde8...39.exe

windows7-x64

4bcf45bde8...39.exe

windows10-2004-x64

5292b8004f...ce.exe

windows7-x64

5292b8004f...ce.exe

windows10-2004-x64

6babc5b52d...53.dll

windows7-x64

6babc5b52d...53.dll

windows10-2004-x64

85b73b7b3c...45.exe

windows7-x64

85b73b7b3c...45.exe

windows10-2004-x64

8eb41b097a...ff.exe

windows7-x64

8eb41b097a...ff.exe

windows10-2004-x64

932380926b...ef.exe

windows7-x64

932380926b...ef.exe

windows10-2004-x64

9d8729b9ca...de.exe

windows7-x64

9d8729b9ca...de.exe

windows10-2004-x64

9e147a3bb2...53.dll

windows7-x64

9e147a3bb2...53.dll

windows10-2004-x64

bccfdc8e1a...96.exe

windows7-x64

bccfdc8e1a...96.exe

windows10-2004-x64

bf5a9bb619...d7.exe

windows7-x64

bf5a9bb619...d7.exe

windows10-2004-x64

d0017384df...0a.exe

windows7-x64

d0017384df...0a.exe

windows10-2004-x64

d72aa8fe30...89.exe

windows7-x64

d72aa8fe30...89.exe

windows10-2004-x64

fa622e0a4d...52.exe

windows7-x64

Resubmissions

15-11-2024 18:05

241115-wpjcdsxrdy 10

11-11-2024 21:40

241111-1h6xbsxcql 10

03-12-2022 17:54

221203-wg4ncscc33 10

Analysis

max time kernel
52s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:40

Sharing

Copy URL

Twitter E-mail

Static task

static1

vmprotect

2 signatures

Behavioral task

behavioral1

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win7-20241010-en

spyware stealer vmprotect

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win10v2004-20241007-en

spyware stealer vmprotect

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win7-20240903-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 discovery stealer

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win10v2004-20241007-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 discovery stealer

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Resource

win10v2004-20241007-en

discovery persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win7-20241010-en

redline logsdiller cloud (tg: @mr_golds)discovery infostealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral9

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win10v2004-20241007-en

redline logsdiller cloud (tg: @mr_golds)discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral10

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win7-20240903-en

redline nam6.1 discovery infostealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral11

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win10v2004-20241007-en

redline nam6.1 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral12

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win7-20240903-en

privateloader discovery evasion loader trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral15

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win10v2004-20241007-en

privateloader discovery evasion loader trojan

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral16

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win7-20240903-en

defense_evasion discovery evasion execution spyware stealer trojan

windows7-x64

23 signatures

150 seconds

Behavioral task

behavioral17

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win10v2004-20241007-en

defense_evasion discovery execution spyware stealer

windows10-2004-x64

22 signatures

150 seconds

Behavioral task

behavioral18

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win7-20241010-en

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral19

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral20

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win7-20241010-en

defense_evasion discovery evasion execution spyware stealer trojan

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral21

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win10v2004-20241007-en

defense_evasion discovery execution spyware stealer

windows10-2004-x64

22 signatures

150 seconds

Behavioral task

behavioral22

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win7-20240903-en

discovery

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral26

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win7-20241023-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win7-20241010-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe
Size

8KB
MD5

fd1489c65b0d75f4cdc7b1f2634b5359
SHA1

f8431629d627f8dc13ca486e8b5d0a46f47d46fd
SHA256

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea
SHA512

e4fc02e1567e188caaf67ccd3a068e6b9db1c20b22a6949ec9ffd9d1a037afe36d744ac8c94a0fd5df55c7e2a51c10a9bcf05c3274175c8296cf16be718a99a2
SSDEEP

96:a9hcOxiPwrltSJ1+pa/4/pzzkZj6tfCIQJ25FsfQungwffm2gbFnU:avc4rvpPd4Z+t6BJyungwffPZ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

description pid process

Token: SeDebugPrivilege 796 463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

description	pid	process
Token: SeDebugPrivilege	796	463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Processes

C:\Users\Admin\AppData\Local\Temp\463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe
"C:\Users\Admin\AppData\Local\Temp\463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-0-0x000007FEF5423000-0x000007FEF5424000-memory.dmp

Filesize
4KB

Download
memory/796-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/796-2-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

Filesize
9.9MB

Download
memory/796-3-0x000007FEF5423000-0x000007FEF5424000-memory.dmp

Filesize
4KB

Download
memory/796-4-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

Filesize
9.9MB

Download