Analysis
- geolocation tags
eueuropefrfrance - user interaction
yes - max time kernel
598s - max time network
438s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260126-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
29/04/2026, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OmesFN.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
OmesFN.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
600 seconds
General
- Target OmesFN.exe
- Size 22.9MB
- Sample260429-tym1tsdw7s
- SHA256 6bd8c1236dd2046ed8d8101c4f3162912ac3749ca2f401113ea2b3af980bb14f
- MD5 587d1c305126a1a4a72d4211a57e6b1c
- SHA1 a12a71f790fda977a900ccfbd3114c6385310132
- SHA512 504f26ec828e54f57ca9e90faba5b18852a110b636a828ea17ed2887b0ba7fdb8a0f0cdd999e54aa5191b30a8dc4faa76f8824a1be23a72a0fdf8f208ddc0642
- SSDEEP 196608:u1eGnUmTMehYsaBX3H0Q5pmfIKX8zew0cD+Rd:u1HnUmoehYsaBX3U8pmD8zH0c2
- TLSH T125373C47E8E21DD9C4EA8670D179822BBA613C1C1B3D23EB1691F3601F36BE05E76761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5072 wmic.exe 5072 wmic.exe 5072 wmic.exe 5072 wmic.exe 4388 OmesFN.exe 4388 OmesFN.exe 4388 OmesFN.exe 4388 OmesFN.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5072 wmic.exe Token: SeSecurityPrivilege 5072 wmic.exe Token: SeTakeOwnershipPrivilege 5072 wmic.exe Token: SeLoadDriverPrivilege 5072 wmic.exe Token: SeSystemProfilePrivilege 5072 wmic.exe Token: SeSystemtimePrivilege 5072 wmic.exe Token: SeProfSingleProcessPrivilege 5072 wmic.exe Token: SeIncBasePriorityPrivilege 5072 wmic.exe Token: SeCreatePagefilePrivilege 5072 wmic.exe Token: SeBackupPrivilege 5072 wmic.exe Token: SeRestorePrivilege 5072 wmic.exe Token: SeShutdownPrivilege 5072 wmic.exe Token: SeDebugPrivilege 5072 wmic.exe Token: SeSystemEnvironmentPrivilege 5072 wmic.exe Token: SeRemoteShutdownPrivilege 5072 wmic.exe Token: SeUndockPrivilege 5072 wmic.exe Token: SeManageVolumePrivilege 5072 wmic.exe Token: 33 5072 wmic.exe Token: 34 5072 wmic.exe Token: 35 5072 wmic.exe Token: 36 5072 wmic.exe Token: SeIncreaseQuotaPrivilege 5072 wmic.exe Token: SeSecurityPrivilege 5072 wmic.exe Token: SeTakeOwnershipPrivilege 5072 wmic.exe Token: SeLoadDriverPrivilege 5072 wmic.exe Token: SeSystemProfilePrivilege 5072 wmic.exe Token: SeSystemtimePrivilege 5072 wmic.exe Token: SeProfSingleProcessPrivilege 5072 wmic.exe Token: SeIncBasePriorityPrivilege 5072 wmic.exe Token: SeCreatePagefilePrivilege 5072 wmic.exe Token: SeBackupPrivilege 5072 wmic.exe Token: SeRestorePrivilege 5072 wmic.exe Token: SeShutdownPrivilege 5072 wmic.exe Token: SeDebugPrivilege 5072 wmic.exe Token: SeSystemEnvironmentPrivilege 5072 wmic.exe Token: SeRemoteShutdownPrivilege 5072 wmic.exe Token: SeUndockPrivilege 5072 wmic.exe Token: SeManageVolumePrivilege 5072 wmic.exe Token: 33 5072 wmic.exe Token: 34 5072 wmic.exe Token: 35 5072 wmic.exe Token: 36 5072 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4388 wrote to memory of 5072 4388 OmesFN.exe 82 PID 4388 wrote to memory of 3048 4388 OmesFN.exe 84 PID 4388 wrote to memory of 4676 4388 OmesFN.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\OmesFN.exe"C:\Users\Admin\AppData\Local\Temp\OmesFN.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get ProcessorId2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\system32\getmac.exegetmac /fo csv /nh2⤵PID:3048
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵PID:4676
-