70bba6e748b04c937188f113389a3c90bf30806add70222b920886a57b0bdd98

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12199d72af0652fdf09349f59304d485.exe
Size

7.9MB
MD5

12199d72af0652fdf09349f59304d485
SHA1

b4d0ce7b6f4f014bbc1235b5c26d2f8304328618
SHA256

07bc2ca1348f662330734e4de3996566587cd7db17fdb137e35c645a872257c0
SHA512

990365aa82b820de02e80ff295bc50b5e1dd57615e906cc485b715baa9df89010034feff825f86bcb046de6d326a6bad26e9cee300fc7e7ea41239f379f6f21d
SSDEEP

196608:i9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBy:imqbhrEbn87eZsFmq+m

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3252	gPkF5.exe

Executes dropped EXE 1 IoCs

pid	Process
3252	gPkF5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5680	12199d72af0652fdf09349f59304d485.exe
5680	12199d72af0652fdf09349f59304d485.exe
5680	12199d72af0652fdf09349f59304d485.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe
3252	gPkF5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	12199d72af0652fdf09349f59304d485.exe
Token: SeDebugPrivilege	3252	gPkF5.exe
Token: SeDebugPrivilege	3252	gPkF5.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 3252	5680	12199d72af0652fdf09349f59304d485.exe	87
PID 5680 wrote to memory of 3252	5680	12199d72af0652fdf09349f59304d485.exe	87

C:\Users\Admin\AppData\Local\Temp\12199d72af0652fdf09349f59304d485.exe
"C:\Users\Admin\AppData\Local\Temp\12199d72af0652fdf09349f59304d485.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Users\Admin\AppData\Local\Temp\gPkF5.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDEyMTk5ZDcyYWYwNjUyZmRmMDkzNDlmNTkzMDRkNDg1LmV4ZQ== 12
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gPkF5.exe

Filesize
7.9MB

MD5
034a4507acc0c35e6dc19684f5de813d

SHA1
158cd3fc6dc88f8ad31acc0863ab356b5bc6b994

SHA256
234c6d71f2f090c574bb5e25e2ba5e331f3eb17c57178f116108b31317042af5

SHA512
5accb113b92915a7418c6e86fbc3ca7f722b57631a6a1b94a3b9c5842ed6d213a3fb83881a45e94f8f359b7daeefb672b2762723088b73f10ec210ea339c3630

Download Submit
memory/3252-19-0x000001CE7B700000-0x000001CE7B738000-memory.dmp

Filesize
224KB

Download
memory/3252-20-0x000001CE7B4E0000-0x000001CE7B4EE000-memory.dmp

Filesize
56KB

Download
memory/3252-30-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/3252-29-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/3252-13-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/3252-14-0x000001CE5DED0000-0x000001CE5F1E2000-memory.dmp

Filesize
19.1MB

Download
memory/3252-15-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/3252-16-0x000001CE60E00000-0x000001CE60E08000-memory.dmp

Filesize
32KB

Download
memory/3252-27-0x000001CE00000000-0x000001CE00A86000-memory.dmp

Filesize
10.5MB

Download
memory/3252-17-0x000001CE60DF0000-0x000001CE60E00000-memory.dmp

Filesize
64KB

Download
memory/3252-18-0x000001CE7B4C0000-0x000001CE7B4C8000-memory.dmp

Filesize
32KB

Download
memory/3252-25-0x000001CE00000000-0x000001CE00A86000-memory.dmp

Filesize
10.5MB

Download
memory/3252-22-0x000001CE00000000-0x000001CE00A86000-memory.dmp

Filesize
10.5MB

Download
memory/3252-24-0x00007FFB45D10000-0x00007FFB45D12000-memory.dmp

Filesize
8KB

Download
memory/5680-0-0x00007FFB27923000-0x00007FFB27925000-memory.dmp

Filesize
8KB

Download
memory/5680-2-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/5680-12-0x00007FFB27920000-0x00007FFB283E1000-memory.dmp

Filesize
10.8MB

Download
memory/5680-1-0x00000170D0310000-0x00000170D1622000-memory.dmp

Filesize
19.1MB

Download