Analysis
- geolocation tags
eueuropefrfrance - max time kernel
598s - max time network
427s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/04/2026, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OmesFN.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
OmesFN.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
600 seconds
General
- Target OmesFN.exe
- Size 22.9MB
- Sample260429-tym1tsdw7s
- SHA256 6bd8c1236dd2046ed8d8101c4f3162912ac3749ca2f401113ea2b3af980bb14f
- MD5 587d1c305126a1a4a72d4211a57e6b1c
- SHA1 a12a71f790fda977a900ccfbd3114c6385310132
- SHA512 504f26ec828e54f57ca9e90faba5b18852a110b636a828ea17ed2887b0ba7fdb8a0f0cdd999e54aa5191b30a8dc4faa76f8824a1be23a72a0fdf8f208ddc0642
- SSDEEP 196608:u1eGnUmTMehYsaBX3H0Q5pmfIKX8zew0cD+Rd:u1HnUmoehYsaBX3U8pmD8zH0c2
- TLSH T125373C47E8E21DD9C4EA8670D179822BBA613C1C1B3D23EB1691F3601F36BE05E76761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5044 wmic.exe Token: SeSecurityPrivilege 5044 wmic.exe Token: SeTakeOwnershipPrivilege 5044 wmic.exe Token: SeLoadDriverPrivilege 5044 wmic.exe Token: SeSystemProfilePrivilege 5044 wmic.exe Token: SeSystemtimePrivilege 5044 wmic.exe Token: SeProfSingleProcessPrivilege 5044 wmic.exe Token: SeIncBasePriorityPrivilege 5044 wmic.exe Token: SeCreatePagefilePrivilege 5044 wmic.exe Token: SeBackupPrivilege 5044 wmic.exe Token: SeRestorePrivilege 5044 wmic.exe Token: SeShutdownPrivilege 5044 wmic.exe Token: SeDebugPrivilege 5044 wmic.exe Token: SeSystemEnvironmentPrivilege 5044 wmic.exe Token: SeRemoteShutdownPrivilege 5044 wmic.exe Token: SeUndockPrivilege 5044 wmic.exe Token: SeManageVolumePrivilege 5044 wmic.exe Token: 33 5044 wmic.exe Token: 34 5044 wmic.exe Token: 35 5044 wmic.exe Token: 36 5044 wmic.exe Token: SeIncreaseQuotaPrivilege 5044 wmic.exe Token: SeSecurityPrivilege 5044 wmic.exe Token: SeTakeOwnershipPrivilege 5044 wmic.exe Token: SeLoadDriverPrivilege 5044 wmic.exe Token: SeSystemProfilePrivilege 5044 wmic.exe Token: SeSystemtimePrivilege 5044 wmic.exe Token: SeProfSingleProcessPrivilege 5044 wmic.exe Token: SeIncBasePriorityPrivilege 5044 wmic.exe Token: SeCreatePagefilePrivilege 5044 wmic.exe Token: SeBackupPrivilege 5044 wmic.exe Token: SeRestorePrivilege 5044 wmic.exe Token: SeShutdownPrivilege 5044 wmic.exe Token: SeDebugPrivilege 5044 wmic.exe Token: SeSystemEnvironmentPrivilege 5044 wmic.exe Token: SeRemoteShutdownPrivilege 5044 wmic.exe Token: SeUndockPrivilege 5044 wmic.exe Token: SeManageVolumePrivilege 5044 wmic.exe Token: 33 5044 wmic.exe Token: 34 5044 wmic.exe Token: 35 5044 wmic.exe Token: 36 5044 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1132 wrote to memory of 5044 1132 OmesFN.exe 87 PID 1132 wrote to memory of 1368 1132 OmesFN.exe 89 PID 1132 wrote to memory of 3140 1132 OmesFN.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\OmesFN.exe"C:\Users\Admin\AppData\Local\Temp\OmesFN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get ProcessorId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\system32\getmac.exegetmac /fo csv /nh2⤵PID:1368
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵PID:3140
-