Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 15:26
Behavioral task
behavioral1
Sample
Celex.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Celex.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Celex.exe
-
Size
37KB
-
MD5
502c8a1e9ebf182539816cd73e6fb745
-
SHA1
6d9b0ef9538c91b2546b6f07015769887a77b08b
-
SHA256
1baf26fadab02970d6f09a9711944ed069d32577f1e0da07967e93f71bb7efb8
-
SHA512
f197f8eb4bb4ddcd11221f066c367dcdf722e72b45efb1cbf80b5ba2db9a04a0d9d10e5a642eb879d1cc184476729765426c5dde9ff69066179a2bc8fe747ad0
-
SSDEEP
384:StP97LsikX9zNf/1uyU7/I3/9sWAnurAF+rMRTyN/0L+EcoinblneHQM3epzXDJv:UPlil1lU7/I1dAurM+rMRa8NupJVt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4364 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Celex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe 1260 Celex.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1260 Celex.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe Token: 33 1260 Celex.exe Token: SeIncBasePriorityPrivilege 1260 Celex.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1260 wrote to memory of 4364 1260 Celex.exe 82 PID 1260 wrote to memory of 4364 1260 Celex.exe 82 PID 1260 wrote to memory of 4364 1260 Celex.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celex.exe"C:\Users\Admin\AppData\Local\Temp\Celex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Celex.exe" "Celex.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4364
-