f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 23:10

Target

101.34.205.247:8080/cs/logon.exe
Size

3.8MB
MD5

60715947f87e5b222b396082e29d443a
SHA1

a68f4ded829712e5b85d9f16fe5318da7f04b404
SHA256

ad1e257c9cb70f062ed1665d3d518543a91573383b2073fd78b8e4fe2138a6e9
SHA512

84f45e09373c4681f8a783c205a2e77b338369925f33a190aa6fcf611067be1fb735c742a4dad976e6080c1b9438dbb061a1738a40f4f841bf4b23ea3032c7c9
SSDEEP

49152:YH5NXYPJJ1m1l43g7W+W3TWkbw8KjY0J5RPXyIW93OxSbAEWCr+leBJkffxN:fPXZ3g7W+WDTcd9A93u8r+c4fxN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4176	logon.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4176	logon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4176	logon.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4176	logon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	logon.exe
Token: SeDebugPrivilege	4176	logon.exe

memory/4176-0-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-1-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-2-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-3-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-4-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-5-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download
memory/4176-8-0x00007FFE4D080000-0x00007FFE4D1AE000-memory.dmp

Filesize
1.2MB

Download
memory/4176-7-0x00007FFE4C530000-0x00007FFE4C955000-memory.dmp

Filesize
4.1MB

Download