760f5ddd00760be411967d77224b29a48e00e1eed0e978ba4017979595d1637e

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65099e4d1aa799000e529ebfb194fca3.exe
Size

7.9MB
MD5

65099e4d1aa799000e529ebfb194fca3
SHA1

2138fa1dea5f14a60aa187a8a7e4420f33071517
SHA256

4962734497a69d1a6ed08dd33ee7d855703b0fecea58d77cfb4974a43974d865
SHA512

a1494b92d296d58b1f6b87a6c17884fa32b9cac458e0f7299ee1aba19c4171f0376bb9c0c666788798587e34151ff7a43777ca3fdb355b7cf59c1c81f8d5b159
SSDEEP

196608:+9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBW:+mqbhrEbn87eZsFmq+y

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2056	XVXSmkA.exe

Executes dropped EXE 2 IoCs

pid	Process
2056	XVXSmkA.exe
1204	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2948	65099e4d1aa799000e529ebfb194fca3.exe
2948	65099e4d1aa799000e529ebfb194fca3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	65099e4d1aa799000e529ebfb194fca3.exe
2948	65099e4d1aa799000e529ebfb194fca3.exe
2948	65099e4d1aa799000e529ebfb194fca3.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe
2056	XVXSmkA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	65099e4d1aa799000e529ebfb194fca3.exe
Token: SeDebugPrivilege	2056	XVXSmkA.exe
Token: SeDebugPrivilege	2056	XVXSmkA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2056	2948	65099e4d1aa799000e529ebfb194fca3.exe	31
PID 2948 wrote to memory of 2056	2948	65099e4d1aa799000e529ebfb194fca3.exe	31
PID 2948 wrote to memory of 2056	2948	65099e4d1aa799000e529ebfb194fca3.exe	31

C:\Users\Admin\AppData\Local\Temp\65099e4d1aa799000e529ebfb194fca3.exe
"C:\Users\Admin\AppData\Local\Temp\65099e4d1aa799000e529ebfb194fca3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\XVXSmkA.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDY1MDk5ZTRkMWFhNzk5MDAwZTUyOWViZmIxOTRmY2EzLmV4ZQ== 40
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XVXSmkA.exe

Filesize
7.9MB

MD5
80a1cb14adff57458d157416d5c0fe20

SHA1
525a29ca380352240011d9c4ed468c6c450beaa9

SHA256
38816dcb29d6ed4dd3625ee9d72c34669c0ca42164e4abe42b5846ceb023530f

SHA512
8908c9c8ad9a092b6c7d78e3cfc7e1d4a875cf819a3a64e96330186da878abac0b8c970c971388b08e125e8d6bb98c180e341ce21df024c460f57698a13ea824

Download Submit
memory/2056-19-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2056-33-0x0000000021AE0000-0x0000000022566000-memory.dmp

Filesize
10.5MB

Download
memory/2056-38-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/2056-37-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2056-18-0x000000013FD00000-0x0000000141012000-memory.dmp

Filesize
19.1MB

Download
memory/2056-36-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2056-21-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/2056-20-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/2056-25-0x0000000021AE0000-0x0000000022566000-memory.dmp

Filesize
10.5MB

Download
memory/2056-31-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2056-17-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2056-34-0x0000000021AE0000-0x0000000022566000-memory.dmp

Filesize
10.5MB

Download
memory/2056-29-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2056-22-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/2056-27-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2948-2-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2948-16-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2948-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/2948-1-0x000000013F870000-0x0000000140B82000-memory.dmp

Filesize
19.1MB

Download