Analysis
- user interaction
yes - max time kernel
56s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 00:00
Behavioral task
behavioral1
Sample
Wizard.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Wizard.exe
- Size 21.2MB
- Sample260418-aasfvsdw5w
- SHA256 6488c712e63d56da9514408c4721c49785dbc1f13ef42ed3b7ade95805e94d18
- MD5 6a81b853e4e47ab343e396a1208c500d
- SHA1 5e7ab68299804ccac8dd83587e56af048bd36dd1
- SHA512 bf72092afeb590e94adf45cfd9adc85965e83a66b47db069d18463cc4f0451912aae47a7f36d3cb6a6fd823279e7822cfc4c30a4de1ecc821301c9ba150733e4
- SSDEEP 393216:uaHLLBr4X6wR/rxq1dVzmOv3cWfycJc3q96hTeenj6A31EGTJzH5er:1H/Bren1Gd5my3cr2c3q9mTe8FE0BH5G
- TLSH T1FC2712D528D251ADC896C931E28D1BFDF1D279C94D79A82FBFC209022A31D93CDB1936
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4196-1-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp themida behavioral1/memory/4196-6-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp themida behavioral1/memory/4196-7-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp themida -
resource yara_rule behavioral1/memory/4196-1-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp vmprotect behavioral1/memory/4196-6-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp vmprotect behavioral1/memory/4196-7-0x00007FF6DA4B0000-0x00007FF6DCB68000-memory.dmp vmprotect - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4196 Wizard.exe 4196 Wizard.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1656 wmic.exe Token: SeSecurityPrivilege 1656 wmic.exe Token: SeTakeOwnershipPrivilege 1656 wmic.exe Token: SeLoadDriverPrivilege 1656 wmic.exe Token: SeSystemProfilePrivilege 1656 wmic.exe Token: SeSystemtimePrivilege 1656 wmic.exe Token: SeProfSingleProcessPrivilege 1656 wmic.exe Token: SeIncBasePriorityPrivilege 1656 wmic.exe Token: SeCreatePagefilePrivilege 1656 wmic.exe Token: SeBackupPrivilege 1656 wmic.exe Token: SeRestorePrivilege 1656 wmic.exe Token: SeShutdownPrivilege 1656 wmic.exe Token: SeDebugPrivilege 1656 wmic.exe Token: SeSystemEnvironmentPrivilege 1656 wmic.exe Token: SeRemoteShutdownPrivilege 1656 wmic.exe Token: SeUndockPrivilege 1656 wmic.exe Token: SeManageVolumePrivilege 1656 wmic.exe Token: 33 1656 wmic.exe Token: 34 1656 wmic.exe Token: 35 1656 wmic.exe Token: 36 1656 wmic.exe Token: SeIncreaseQuotaPrivilege 1656 wmic.exe Token: SeSecurityPrivilege 1656 wmic.exe Token: SeTakeOwnershipPrivilege 1656 wmic.exe Token: SeLoadDriverPrivilege 1656 wmic.exe Token: SeSystemProfilePrivilege 1656 wmic.exe Token: SeSystemtimePrivilege 1656 wmic.exe Token: SeProfSingleProcessPrivilege 1656 wmic.exe Token: SeIncBasePriorityPrivilege 1656 wmic.exe Token: SeCreatePagefilePrivilege 1656 wmic.exe Token: SeBackupPrivilege 1656 wmic.exe Token: SeRestorePrivilege 1656 wmic.exe Token: SeShutdownPrivilege 1656 wmic.exe Token: SeDebugPrivilege 1656 wmic.exe Token: SeSystemEnvironmentPrivilege 1656 wmic.exe Token: SeRemoteShutdownPrivilege 1656 wmic.exe Token: SeUndockPrivilege 1656 wmic.exe Token: SeManageVolumePrivilege 1656 wmic.exe Token: 33 1656 wmic.exe Token: 34 1656 wmic.exe Token: 35 1656 wmic.exe Token: 36 1656 wmic.exe Token: SeIncreaseQuotaPrivilege 3788 wmic.exe Token: SeSecurityPrivilege 3788 wmic.exe Token: SeTakeOwnershipPrivilege 3788 wmic.exe Token: SeLoadDriverPrivilege 3788 wmic.exe Token: SeSystemProfilePrivilege 3788 wmic.exe Token: SeSystemtimePrivilege 3788 wmic.exe Token: SeProfSingleProcessPrivilege 3788 wmic.exe Token: SeIncBasePriorityPrivilege 3788 wmic.exe Token: SeCreatePagefilePrivilege 3788 wmic.exe Token: SeBackupPrivilege 3788 wmic.exe Token: SeRestorePrivilege 3788 wmic.exe Token: SeShutdownPrivilege 3788 wmic.exe Token: SeDebugPrivilege 3788 wmic.exe Token: SeSystemEnvironmentPrivilege 3788 wmic.exe Token: SeRemoteShutdownPrivilege 3788 wmic.exe Token: SeUndockPrivilege 3788 wmic.exe Token: SeManageVolumePrivilege 3788 wmic.exe Token: 33 3788 wmic.exe Token: 34 3788 wmic.exe Token: 35 3788 wmic.exe Token: 36 3788 wmic.exe Token: SeIncreaseQuotaPrivilege 3788 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4196 wrote to memory of 1656 4196 Wizard.exe 85 PID 4196 wrote to memory of 3788 4196 Wizard.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wizard.exe"C:\Users\Admin\AppData\Local\Temp\Wizard.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3380