f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 23:10

Target

101.34.205.247:8080/checker.exe
Size

3.3MB
MD5

db5bcf288ed2d590ee3fcaaba9ce6ebd
SHA1

fc2bb4a598f7c96f086c64ed192d38a988fe6d8a
SHA256

485cac639b15862e040235619fb8b07ad41617ff0261fc268b9406836f55d0f6
SHA512

68c6de068ce0f67d8fb81518b73b21efb95e1d60d37166421db7e4e451bd6dc1bdcd1c19d428700c1f4662c79a6347b0b447b35959f0d58229f89429182c2090
SSDEEP

49152:4H5NXYPJJ1m1l43g7W+W3TWkbw8KjY0J5RPXyIW93OxSbAEWCW:/PXZ3g7W+WDTcd9A93u8W

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1156	checker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1156	checker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1156	checker.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1156	checker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	checker.exe
Token: SeDebugPrivilege	1156	checker.exe

memory/1156-0-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-1-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-2-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-3-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-4-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-5-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download
memory/1156-8-0x00007FFAF2F50000-0x00007FFAF307E000-memory.dmp

Filesize
1.2MB

Download
memory/1156-7-0x00007FFAF3080000-0x00007FFAF34A5000-memory.dmp

Filesize
4.1MB

Download