d480cb485075e7faad2c5b863f98d0c546827a8bfe1a9611e1be09b8dd5bca90

Analysis

max time kernel
138s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2025, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Toxic/004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Size 11.9MB
Sample250619-whfmxsem71
SHA256 004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb
MD5 330c57ba797e427c702d0a69b05b7261
SHA1 cf7203b5548524bc82a9fc49044fcd2bdd191529
SHA512 3d135dbcc1b3486e39c80a550b163ff302d7638c75d354d832e0b23fb3cf750feba659dfdb21963a80e8c66452199000043d0cfe696d4ffa7e4776b862a00b27
SSDEEP 196608:HpddMSiWvYu2HiWxnJVkD3Rll3y5LIhH7FJ:JdiDWvYu2Hi+nJVkD3Rll3y5LIjJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	api.ipify.org
30	api.ipify.org
33	ip-api.com

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeImpersonatePrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeProfSingleProcessPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeTakeOwnershipPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeBackupPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeRestorePrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeIncBasePriorityPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: 33	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeSecurityPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeIncreaseQuotaPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeShutdownPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeAssignPrimaryTokenPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
Token: SeIncBasePriorityPrivilege	4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4796	004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe

C:\Users\Admin\AppData\Local\Temp\Toxic\004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
"C:\Users\Admin\AppData\Local\Temp\Toxic\004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads