5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91e6d47bd804e58a4e160993dfdfc3cc.exe
Size

7.9MB
MD5

91e6d47bd804e58a4e160993dfdfc3cc
SHA1

c273d38db777c882addc54c595e392b587aaa980
SHA256

7480338642edf06769bc62a28e084eb5cd9487868f95543337ebe8a9c32c7093
SHA512

ae0663df09766e33194f844d101f072ecf8af8af4081897256dea24bbce1b3ff38473dbf80d23e7eaf74930f0d42a6b45a80930425cbd43e3e8daade219a2a62
SSDEEP

196608:G9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZB2:GmqbhrEbn87eZsFmq+6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2248	3ZM65l.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	3ZM65l.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	91e6d47bd804e58a4e160993dfdfc3cc.exe
2956	91e6d47bd804e58a4e160993dfdfc3cc.exe
2956	91e6d47bd804e58a4e160993dfdfc3cc.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe
2248	3ZM65l.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	91e6d47bd804e58a4e160993dfdfc3cc.exe
Token: SeDebugPrivilege	2248	3ZM65l.exe
Token: SeDebugPrivilege	2248	3ZM65l.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2248	2956	91e6d47bd804e58a4e160993dfdfc3cc.exe	88
PID 2956 wrote to memory of 2248	2956	91e6d47bd804e58a4e160993dfdfc3cc.exe	88

C:\Users\Admin\AppData\Local\Temp\91e6d47bd804e58a4e160993dfdfc3cc.exe
"C:\Users\Admin\AppData\Local\Temp\91e6d47bd804e58a4e160993dfdfc3cc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\3ZM65l.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDkxZTZkNDdiZDgwNGU1OGE0ZTE2MDk5M2RmZGZjM2NjLmV4ZQ== 38
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ZM65l.exe

Filesize
7.9MB

MD5
60e2f8a3c1bae7b743d511e657f4deff

SHA1
6332fdfb010adf74471721cfc0daa4d88dadcd83

SHA256
c84607e9496d67711c7dfcdea523c34fdaf689a41b91f9e2f14123f05553474e

SHA512
50e7bd6622fdc57e50a4f99bc36b04b5cbf842b2bbbbdea60f6806cdc1dc0eafce4abbd8e4fa195989c9128e6e643737ca56eb9109f547226cd372b32a5105d1

Download Submit
memory/2248-19-0x000001C8F7FD0000-0x000001C8F8008000-memory.dmp

Filesize
224KB

Download
memory/2248-20-0x000001C8F7FA0000-0x000001C8F7FAE000-memory.dmp

Filesize
56KB

Download
memory/2248-30-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2248-29-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2248-12-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2248-14-0x000001C8DA810000-0x000001C8DBB22000-memory.dmp

Filesize
19.1MB

Download
memory/2248-15-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2248-16-0x000001C8DC180000-0x000001C8DC188000-memory.dmp

Filesize
32KB

Download
memory/2248-27-0x000001C8FC6B0000-0x000001C8FD136000-memory.dmp

Filesize
10.5MB

Download
memory/2248-17-0x000001C8DC170000-0x000001C8DC180000-memory.dmp

Filesize
64KB

Download
memory/2248-18-0x000001C8F7F50000-0x000001C8F7F58000-memory.dmp

Filesize
32KB

Download
memory/2248-25-0x000001C8FC6B0000-0x000001C8FD136000-memory.dmp

Filesize
10.5MB

Download
memory/2248-23-0x000001C8FC6B0000-0x000001C8FD136000-memory.dmp

Filesize
10.5MB

Download
memory/2248-24-0x00007FFB66230000-0x00007FFB66232000-memory.dmp

Filesize
8KB

Download
memory/2956-0-0x00007FFB47E93000-0x00007FFB47E95000-memory.dmp

Filesize
8KB

Download
memory/2956-2-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2956-13-0x00007FFB47E90000-0x00007FFB48951000-memory.dmp

Filesize
10.8MB

Download
memory/2956-1-0x000001EF2EAC0000-0x000001EF2FDD2000-memory.dmp

Filesize
19.1MB

Download