249f9bd035685660ae45fc4138334e744c30ce7e1038c140a98529b90c4270c5

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df9cc0d83fdf3053b95b91afe74fa035.exe
Size

7.9MB
MD5

df9cc0d83fdf3053b95b91afe74fa035
SHA1

daba73ed9762fa5acf66855971b751aaf31da78b
SHA256

d859e26169204f7ac64c0fa11e7b32d23c22d92992f7778d825fe7cf0095ce4c
SHA512

c8cd7b4bdfc9fe337e26c13e3373b492d20d8e91ff1daeb375037d79ae04b4c7fe632395c328c3e097a43c3177a448c372edc9b7bc5cf9f74cf4724dd6589c87
SSDEEP

196608:z9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBb:zmqbhrEbn87eZsFmq+H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2764	Lzjx4gY.exe

Executes dropped EXE 2 IoCs

pid	Process
2764	Lzjx4gY.exe
1268	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
1600	df9cc0d83fdf3053b95b91afe74fa035.exe
1600	df9cc0d83fdf3053b95b91afe74fa035.exe
1268	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1600	df9cc0d83fdf3053b95b91afe74fa035.exe
1600	df9cc0d83fdf3053b95b91afe74fa035.exe
1600	df9cc0d83fdf3053b95b91afe74fa035.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe
2764	Lzjx4gY.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	df9cc0d83fdf3053b95b91afe74fa035.exe
Token: SeDebugPrivilege	2764	Lzjx4gY.exe
Token: SeDebugPrivilege	2764	Lzjx4gY.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2764	1600	df9cc0d83fdf3053b95b91afe74fa035.exe	30
PID 1600 wrote to memory of 2764	1600	df9cc0d83fdf3053b95b91afe74fa035.exe	30
PID 1600 wrote to memory of 2764	1600	df9cc0d83fdf3053b95b91afe74fa035.exe	30

C:\Users\Admin\AppData\Local\Temp\df9cc0d83fdf3053b95b91afe74fa035.exe
"C:\Users\Admin\AppData\Local\Temp\df9cc0d83fdf3053b95b91afe74fa035.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\Lzjx4gY.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGRmOWNjMGQ4M2ZkZjMwNTNiOTViOTFhZmU3NGZhMDM1LmV4ZQ== 34
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lzjx4gY.exe

Filesize
7.9MB

MD5
1aa21b00122d3e302c3baa0e233c017d

SHA1
f8d6001fc48f59a298703a040bcebe73ce720646

SHA256
718928733008b5b8fed9f35544654ef5f2ad737bb26f1efd41ae995665b1c60f

SHA512
45539d927695c6e5b797b1a5b0ce22a886191c065872517bdba44c65c2b1e206b4a6032e84177566cc6198e9a2e9717069f82db635e606e580dc7053088c0f2f

Download Submit
memory/1600-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Filesize
4KB

Download
memory/1600-1-0x000000013F030000-0x0000000140342000-memory.dmp

Filesize
19.1MB

Download
memory/1600-2-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/1600-16-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-22-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/2764-33-0x0000000022070000-0x0000000022AF6000-memory.dmp

Filesize
10.5MB

Download
memory/2764-21-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/2764-20-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/2764-19-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-17-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-26-0x0000000022070000-0x0000000022AF6000-memory.dmp

Filesize
10.5MB

Download
memory/2764-18-0x000000013F2F0000-0x0000000140602000-memory.dmp

Filesize
19.1MB

Download
memory/2764-35-0x0000000022070000-0x0000000022AF6000-memory.dmp

Filesize
10.5MB

Download
memory/2764-32-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

Filesize
8KB

Download
memory/2764-30-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

Filesize
8KB

Download
memory/2764-28-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

Filesize
8KB

Download
memory/2764-37-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-38-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-39-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download