e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8

Login
Reports

Overview

overview

Static

static

d92866420d...ea.exe

windows7-x64

d92866420d...ea.exe

windows10-2004-x64

d986bd8230...2e.exe

windows7-x64

d986bd8230...2e.exe

windows10-2004-x64

d9a7a84e51...74.exe

windows7-x64

d9a7a84e51...74.exe

windows10-2004-x64

d9cf29b555...3f.exe

windows7-x64

d9cf29b555...3f.exe

windows10-2004-x64

d9d8ce72be...b6.exe

windows7-x64

d9d8ce72be...b6.exe

windows10-2004-x64

da04c1cc45...42.exe

windows7-x64

da04c1cc45...42.exe

windows10-2004-x64

da2ab0267a...4d.exe

windows7-x64

da2ab0267a...4d.exe

windows10-2004-x64

da4889c628...ff.exe

windows7-x64

da4889c628...ff.exe

windows10-2004-x64

da73f61369...a3.exe

windows7-x64

da73f61369...a3.exe

windows10-2004-x64

dadf12489e...10.exe

windows7-x64

dadf12489e...10.exe

windows10-2004-x64

dae2049164...df.exe

windows7-x64

dae2049164...df.exe

windows10-2004-x64

db06d80b63...7f.exe

windows7-x64

db06d80b63...7f.exe

windows10-2004-x64

db0b5b8185...a6.exe

windows7-x64

db0b5b8185...a6.exe

windows10-2004-x64

db34bce8df...eb.exe

windows7-x64

db34bce8df...eb.exe

windows10-2004-x64

db41218c5e...fd.exe

windows7-x64

db41218c5e...fd.exe

windows10-2004-x64

db547399ad...cd.exe

windows7-x64

db547399ad...cd.exe

windows10-2004-x64

Analysis

max time kernel
76s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL Twitter E-mail

Static task

static1

6 signatures

Behavioral task

behavioral1

Sample

d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Resource

win7-20240903-en

windows7-x64

15 signatures

150 seconds

defense_evasion execution trojan

Behavioral task

behavioral2

Sample

d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

17 signatures

150 seconds

defense_evasion execution trojan

Behavioral task

behavioral3

Sample

d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

discovery persistence

Behavioral task

behavioral4

Sample

d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

7 signatures

150 seconds

discovery persistence

Behavioral task

behavioral5

Sample

d9a7a84e51c67d1a641349c9195c4f74.exe

Resource

win7-20241010-en

windows7-x64

19 signatures

150 seconds

dcrat defense_evasion execution infostealer persistence rat trojan

Behavioral task

behavioral6

Sample

d9a7a84e51c67d1a641349c9195c4f74.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

22 signatures

150 seconds

dcrat defense_evasion execution infostealer persistence rat trojan

Behavioral task

behavioral7

Sample

d9cf29b5554af511c587d42fc89b333f.exe

Resource

win7-20240903-en

windows7-x64

14 signatures

150 seconds

xworm execution persistence rat trojan

Behavioral task

behavioral8

Sample

d9cf29b5554af511c587d42fc89b333f.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

15 signatures

150 seconds

xworm execution persistence rat trojan

Behavioral task

behavioral9

Sample

d9d8ce72bea14182d0909964ca07a8b6.exe

Resource

win7-20240903-en

windows7-x64

13 signatures

150 seconds

dcrat infostealer rat

Behavioral task

behavioral10

Sample

d9d8ce72bea14182d0909964ca07a8b6.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

16 signatures

150 seconds

dcrat infostealer rat

Behavioral task

behavioral11

Sample

da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe

Resource

win7-20240903-en

windows7-x64

14 signatures

150 seconds

dcrat execution infostealer rat

Behavioral task

behavioral12

Sample

da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

16 signatures

150 seconds

dcrat execution infostealer rat

Behavioral task

behavioral13

Sample

da2ab0267a2a37786edfb78c7a6a694d.exe

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

discovery persistence

Behavioral task

behavioral14

Sample

da2ab0267a2a37786edfb78c7a6a694d.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

13 signatures

150 seconds

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

Behavioral task

behavioral15

Sample

da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe

Resource

win7-20240729-en

windows7-x64

13 signatures

150 seconds

remcos host discovery persistence rat spyware stealer

Behavioral task

behavioral16

Sample

da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

13 signatures

150 seconds

remcos host discovery persistence rat spyware stealer

Behavioral task

behavioral17

Sample

da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe

Resource

win7-20250207-en

windows7-x64

19 signatures

150 seconds

collection credential_access discovery persistence spyware stealer

Behavioral task

behavioral18

Sample

da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

19 signatures

150 seconds

collection credential_access discovery persistence spyware stealer

Behavioral task

behavioral19

Sample

dadf12489ed76150718a6ef93c7fe010.exe

Resource

win7-20240903-en

windows7-x64

18 signatures

150 seconds

dcrat defense_evasion execution infostealer rat trojan

Behavioral task

behavioral20

Sample

dadf12489ed76150718a6ef93c7fe010.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

19 signatures

150 seconds

dcrat defense_evasion execution infostealer rat trojan

Behavioral task

behavioral21

Sample

dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe

Resource

win7-20240903-en

windows7-x64

19 signatures

150 seconds

collection credential_access discovery persistence spyware stealer

Behavioral task

behavioral22

Sample

dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

19 signatures

150 seconds

collection credential_access discovery persistence spyware stealer

Behavioral task

behavioral23

Sample

db06d80b635eadd508aae82af68fb07f.exe

Resource

win7-20241010-en

windows7-x64

14 signatures

150 seconds

xworm execution persistence rat trojan

Behavioral task

behavioral24

Sample

db06d80b635eadd508aae82af68fb07f.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

15 signatures

150 seconds

xworm execution persistence rat trojan

Behavioral task

behavioral25

Sample

db0b5b8185efd6ca7c3f569aec811ea6.exe

Resource

win7-20241010-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

db0b5b8185efd6ca7c3f569aec811ea6.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

db34bce8df2aa261ca6ff400843ca6eb.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

db34bce8df2aa261ca6ff400843ca6eb.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

db547399adb1223b51dd04ca54bc0dcd.exe

Resource

win7-20240903-en

windows7-x64

15 signatures

150 seconds

defense_evasion execution trojan

Behavioral task

behavioral32

Sample

db547399adb1223b51dd04ca54bc0dcd.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

17 signatures

150 seconds

defense_evasion execution trojan

Report Analysis Logs

General

Target
db34bce8df2aa261ca6ff400843ca6eb.exe
Size 20.0MB
Sample250322-g17rssy1ev
SHA256 b500f2020692d8b941db3f3ece9ebdaa043100da525da081a574318cebe132c3
MD5 db34bce8df2aa261ca6ff400843ca6eb
SHA1 58c310b630199f8e1213f5a94d8fc1a09013c064
SHA512 1ecb24e1596ffad4e80f4296886843b5608464e83b0fef64727febba28cdbf12df6355528441b8591c76e1f69ae29323f91a2891f80ed4cd6e6208ab230e016f
SSDEEP 196608:RQXY82cxqAOz8vuoTyQWzLRRXpFrq86wEIWM0y06wrR:cicxqAOz8vuozWzlRZFu+EIWM+6wN
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	db34bce8df2aa261ca6ff400843ca6eb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\db34bce8df2aa261ca6ff400843ca6eb.exe
"C:\Users\Admin\AppData\Local\Temp\db34bce8df2aa261ca6ff400843ca6eb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-0-0x00007FFD630C3000-0x00007FFD630C5000-memory.dmp

Download

memory/3524-1-0x0000000000320000-0x0000000000B22000-memory.dmp

Download

memory/3524-2-0x00007FFD630C0000-0x00007FFD63B81000-memory.dmp

Download

memory/3524-3-0x00007FFD630C0000-0x00007FFD63B81000-memory.dmp

Download