Analysis
- user interaction
yes - max time kernel
64s - max time network
66s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 00:00
Behavioral task
behavioral1
Sample
Wizard.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Wizard.exe
- Size 21.2MB
- Sample260418-aasfvsdw5w
- SHA256 6488c712e63d56da9514408c4721c49785dbc1f13ef42ed3b7ade95805e94d18
- MD5 6a81b853e4e47ab343e396a1208c500d
- SHA1 5e7ab68299804ccac8dd83587e56af048bd36dd1
- SHA512 bf72092afeb590e94adf45cfd9adc85965e83a66b47db069d18463cc4f0451912aae47a7f36d3cb6a6fd823279e7822cfc4c30a4de1ecc821301c9ba150733e4
- SSDEEP 393216:uaHLLBr4X6wR/rxq1dVzmOv3cWfycJc3q96hTeenj6A31EGTJzH5er:1H/Bren1Gd5my3cr2c3q9mTe8FE0BH5G
- TLSH T1FC2712D528D251ADC896C931E28D1BFDF1D279C94D79A82FBFC209022A31D93CDB1936
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4896-1-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp themida behavioral2/memory/4896-6-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp themida behavioral2/memory/4896-10-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp themida -
resource yara_rule behavioral2/memory/4896-1-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp vmprotect behavioral2/memory/4896-6-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp vmprotect behavioral2/memory/4896-10-0x00007FF6805D0000-0x00007FF682C88000-memory.dmp vmprotect - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 1 api.ipify.org - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4896 Wizard.exe 4896 Wizard.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4524 wmic.exe Token: SeSecurityPrivilege 4524 wmic.exe Token: SeTakeOwnershipPrivilege 4524 wmic.exe Token: SeLoadDriverPrivilege 4524 wmic.exe Token: SeSystemProfilePrivilege 4524 wmic.exe Token: SeSystemtimePrivilege 4524 wmic.exe Token: SeProfSingleProcessPrivilege 4524 wmic.exe Token: SeIncBasePriorityPrivilege 4524 wmic.exe Token: SeCreatePagefilePrivilege 4524 wmic.exe Token: SeBackupPrivilege 4524 wmic.exe Token: SeRestorePrivilege 4524 wmic.exe Token: SeShutdownPrivilege 4524 wmic.exe Token: SeDebugPrivilege 4524 wmic.exe Token: SeSystemEnvironmentPrivilege 4524 wmic.exe Token: SeRemoteShutdownPrivilege 4524 wmic.exe Token: SeUndockPrivilege 4524 wmic.exe Token: SeManageVolumePrivilege 4524 wmic.exe Token: 33 4524 wmic.exe Token: 34 4524 wmic.exe Token: 35 4524 wmic.exe Token: 36 4524 wmic.exe Token: SeIncreaseQuotaPrivilege 4524 wmic.exe Token: SeSecurityPrivilege 4524 wmic.exe Token: SeTakeOwnershipPrivilege 4524 wmic.exe Token: SeLoadDriverPrivilege 4524 wmic.exe Token: SeSystemProfilePrivilege 4524 wmic.exe Token: SeSystemtimePrivilege 4524 wmic.exe Token: SeProfSingleProcessPrivilege 4524 wmic.exe Token: SeIncBasePriorityPrivilege 4524 wmic.exe Token: SeCreatePagefilePrivilege 4524 wmic.exe Token: SeBackupPrivilege 4524 wmic.exe Token: SeRestorePrivilege 4524 wmic.exe Token: SeShutdownPrivilege 4524 wmic.exe Token: SeDebugPrivilege 4524 wmic.exe Token: SeSystemEnvironmentPrivilege 4524 wmic.exe Token: SeRemoteShutdownPrivilege 4524 wmic.exe Token: SeUndockPrivilege 4524 wmic.exe Token: SeManageVolumePrivilege 4524 wmic.exe Token: 33 4524 wmic.exe Token: 34 4524 wmic.exe Token: 35 4524 wmic.exe Token: 36 4524 wmic.exe Token: SeIncreaseQuotaPrivilege 5160 wmic.exe Token: SeSecurityPrivilege 5160 wmic.exe Token: SeTakeOwnershipPrivilege 5160 wmic.exe Token: SeLoadDriverPrivilege 5160 wmic.exe Token: SeSystemProfilePrivilege 5160 wmic.exe Token: SeSystemtimePrivilege 5160 wmic.exe Token: SeProfSingleProcessPrivilege 5160 wmic.exe Token: SeIncBasePriorityPrivilege 5160 wmic.exe Token: SeCreatePagefilePrivilege 5160 wmic.exe Token: SeBackupPrivilege 5160 wmic.exe Token: SeRestorePrivilege 5160 wmic.exe Token: SeShutdownPrivilege 5160 wmic.exe Token: SeDebugPrivilege 5160 wmic.exe Token: SeSystemEnvironmentPrivilege 5160 wmic.exe Token: SeRemoteShutdownPrivilege 5160 wmic.exe Token: SeUndockPrivilege 5160 wmic.exe Token: SeManageVolumePrivilege 5160 wmic.exe Token: 33 5160 wmic.exe Token: 34 5160 wmic.exe Token: 35 5160 wmic.exe Token: 36 5160 wmic.exe Token: SeIncreaseQuotaPrivilege 5160 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4524 4896 Wizard.exe 79 PID 4896 wrote to memory of 5160 4896 Wizard.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wizard.exe"C:\Users\Admin\AppData\Local\Temp\Wizard.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5160
-