249f9bd035685660ae45fc4138334e744c30ce7e1038c140a98529b90c4270c5

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df9cc0d83fdf3053b95b91afe74fa035.exe
Size

7.9MB
MD5

df9cc0d83fdf3053b95b91afe74fa035
SHA1

daba73ed9762fa5acf66855971b751aaf31da78b
SHA256

d859e26169204f7ac64c0fa11e7b32d23c22d92992f7778d825fe7cf0095ce4c
SHA512

c8cd7b4bdfc9fe337e26c13e3373b492d20d8e91ff1daeb375037d79ae04b4c7fe632395c328c3e097a43c3177a448c372edc9b7bc5cf9f74cf4724dd6589c87
SSDEEP

196608:z9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBb:zmqbhrEbn87eZsFmq+H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
872	beWI5.exe

Executes dropped EXE 1 IoCs

pid	Process
872	beWI5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	df9cc0d83fdf3053b95b91afe74fa035.exe
5024	df9cc0d83fdf3053b95b91afe74fa035.exe
5024	df9cc0d83fdf3053b95b91afe74fa035.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe
872	beWI5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	df9cc0d83fdf3053b95b91afe74fa035.exe
Token: SeDebugPrivilege	872	beWI5.exe
Token: SeDebugPrivilege	872	beWI5.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 872	5024	df9cc0d83fdf3053b95b91afe74fa035.exe	88
PID 5024 wrote to memory of 872	5024	df9cc0d83fdf3053b95b91afe74fa035.exe	88

C:\Users\Admin\AppData\Local\Temp\df9cc0d83fdf3053b95b91afe74fa035.exe
"C:\Users\Admin\AppData\Local\Temp\df9cc0d83fdf3053b95b91afe74fa035.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\beWI5.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGRmOWNjMGQ4M2ZkZjMwNTNiOTViOTFhZmU3NGZhMDM1LmV4ZQ== 15
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\beWI5.exe

Filesize
7.9MB

MD5
46678c208c22a0de28a9daf348cf96a5

SHA1
2085c47f64b04de71460ea8790fea8ac08d6b0b6

SHA256
f168fca230cd50343432f5b69c7b93941859a503098840f72f550e04ce0890bb

SHA512
bbccce5febf2161f5c68e0117fec40211d4913bdfc9b5aa19a1f069b2e766f94aefeef5193becb0f5564036ba53afe731dd22f63c7499cfb0320fb7dc148ce03

Download Submit
memory/872-20-0x0000018D43650000-0x0000018D4365E000-memory.dmp

Filesize
56KB

Download
memory/872-19-0x0000018D43680000-0x0000018D436B8000-memory.dmp

Filesize
224KB

Download
memory/872-30-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/872-29-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/872-12-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/872-14-0x0000018D25D90000-0x0000018D270A2000-memory.dmp

Filesize
19.1MB

Download
memory/872-15-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/872-16-0x0000018D41590000-0x0000018D41598000-memory.dmp

Filesize
32KB

Download
memory/872-27-0x0000018D47BF0000-0x0000018D48676000-memory.dmp

Filesize
10.5MB

Download
memory/872-17-0x0000018D41580000-0x0000018D41590000-memory.dmp

Filesize
64KB

Download
memory/872-18-0x0000018D43600000-0x0000018D43608000-memory.dmp

Filesize
32KB

Download
memory/872-26-0x0000018D47BF0000-0x0000018D48676000-memory.dmp

Filesize
10.5MB

Download
memory/872-23-0x0000018D47BF0000-0x0000018D48676000-memory.dmp

Filesize
10.5MB

Download
memory/872-24-0x00007FFE04610000-0x00007FFE04612000-memory.dmp

Filesize
8KB

Download
memory/5024-0-0x00007FFDE5E33000-0x00007FFDE5E35000-memory.dmp

Filesize
8KB

Download
memory/5024-2-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/5024-13-0x00007FFDE5E30000-0x00007FFDE68F1000-memory.dmp

Filesize
10.8MB

Download
memory/5024-1-0x000001E7C79C0000-0x000001E7C8CD2000-memory.dmp

Filesize
19.1MB

Download