b9cae0739fc6daee051551b3e1dfabd39db41c2996f3a905254a71def555ba36

Analysis

max time kernel
103s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603d00b49e0ee1b9c5022174ab248b6c.exe
Size

18KB
MD5

603d00b49e0ee1b9c5022174ab248b6c
SHA1

fd93a10b32cced522ca6274f781066a9fab8af17
SHA256

8d19be51751f0c459874ae1dc1be93fb7e667bc916f5b11eeb67943b479cb0e9
SHA512

226f971bb04ba4f0548ad207a308567a5dc7ee1aea5ff933e020e457c38e53a7c8c899e8cd036060c4f1aca7e157c6d076c22422f318cd626b323e558e57f865
SSDEEP

384:6d+cgTYymL0Tybt/yLp3Ejf0TgShmWTkK6aHv+P:qpxwTyBcEjylTA

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	964	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5948	3968	603d00b49e0ee1b9c5022174ab248b6c.exe	90
PID 3968 wrote to memory of 5948	3968	603d00b49e0ee1b9c5022174ab248b6c.exe	90
PID 5948 wrote to memory of 4536	5948	csc.exe	91
PID 5948 wrote to memory of 4536	5948	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\603d00b49e0ee1b9c5022174ab248b6c.exe
"C:\Users\Admin\AppData\Local\Temp\603d00b49e0ee1b9c5022174ab248b6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\okblojxu\okblojxu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7639.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD5F9A7FAFACC4D218562B0A1D3943B37.TMP"
    3⤵
    PID:4536

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c0 0x464
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\089848b3-b2ac-4922-b373-0a3bdd42857d.exe

Filesize
18KB

MD5
f4843e86f1b64366ee16a7a77c8d49c9

SHA1
6aaf86213a5f64fa5389f78625ce7240d727446a

SHA256
5b85bc8ac8fb1c917df8ccede82b559efc43dc438b16fac9ad6e930d7ab5ab2f

SHA512
b92f5a867f39eb1b56d7ce86df142c60308d1eae2c7ac487fa225cc5a3f4b238eecba8660b92ac53a88e59101aad8c659b9f9af9d07db289788c48fce18566ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7639.tmp

Filesize
1KB

MD5
e12f204739d91cf390ff3df518a48f5d

SHA1
6a82dbb1d53ce71339873a9a973b05baaf82d93b

SHA256
48782d59f3156f6bb1618d0b736e986853f298a9d7658d170f3f802b4e0b8c0d

SHA512
9c62230c3428f3437c49db27de4f7a3e09a982714f73fe8c9538049bec261ff95183d660face113f3fee51da200f70cd7b8e86807829b03c04ebb4e635b19921

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCD5F9A7FAFACC4D218562B0A1D3943B37.TMP

Filesize
1KB

MD5
254418401363b198b244a70b1e1318b3

SHA1
d59a5f46c62a5e6e1fcd94ad40f9ad4c7d6f59c8

SHA256
dc58fa583774724c9c6ab1e6be6e95e26a2ac916572eda3d3db7dcbbd7ac6ecb

SHA512
42e5a9342b8889861262dd08dbe7e7bc9e3266fdf782ae42d68ef795fad4d816bf9e4c426f139c1c849a42832568afb7eddc3b761f4be281485b4f8e9eac99e6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\okblojxu\okblojxu.0.cs

Filesize
41KB

MD5
a1577de419fb243a207391ccb5fce254

SHA1
291ae67f162a856f903c3659730265b0f5fc4722

SHA256
8580961d6b5b62226331ea88bb0875f35f5f73a67787cc7ad5633ef708750cce

SHA512
c63b5dcd09e0061c8a4033c717339c27cf9e81fe00b0e75299eff8d0b465ed57e564f3ecb455dc45af5870e9365ad8b900680b74947f920d3c3901a5540ceac5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\okblojxu\okblojxu.cmdline

Filesize
377B

MD5
9b054dea8c8d2aacf6f147f807a046c1

SHA1
13e802fc2d64d9c9d674e34c45c0baaa24ed05c7

SHA256
e7a5cd4b98f3ebc12a7f41cb71087c9192606677af5e3c20e4f51513dad91608

SHA512
1dfc32c6f0830a8a4a83e48e051494ff16a8534ea10b2690cc34ffb4b735dfe23f581a4eafcd57edee6314bd4731cbb0c479911da701805f3f965203b7de6a33

Download Submit
memory/3968-0-0x00007FFB211A3000-0x00007FFB211A5000-memory.dmp

Filesize
8KB

Download
memory/3968-1-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download
memory/3968-3-0x00007FFB211A0000-0x00007FFB21C61000-memory.dmp

Filesize
10.8MB

Download
memory/3968-16-0x0000000001780000-0x000000000178A000-memory.dmp

Filesize
40KB

Download
memory/3968-18-0x00007FFB211A3000-0x00007FFB211A5000-memory.dmp

Filesize
8KB

Download
memory/3968-19-0x00007FFB211A0000-0x00007FFB21C61000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads