Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe
- Size 1.3MB
- Sample260710-evyktsd191
- SHA256 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2
- MD5 3632319c767358c6f389f52798a51e09
- SHA1 aedef04628d5a513bee7c785c13111301bbec7d2
- SHA512 1148bf5e5ab7fd1a53cb3e4b6c8963c6ded48fc07b3817fd0103128abeffca0853decb962285c21e079d38d9d8ca8ea738c49ba7462129dd8254101a95798b2a
- SSDEEP 24576:LHHUMMS3MsdwofKrMWFIiRqB1d6U1bHHd+dZZO0fMj:bPMScoCrMW6JvoU1bUHQ
- TLSH T12455BF16E3E641E8DC36CB388A656722F97178025F34A9DF1290472A3F73EA05E3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\moe_map\moe_map.log 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe File opened for modification C:\Windows\moe_map\global.dat 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1424 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe 1424 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1424 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1424 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe"C:\Users\Admin\AppData\Local\Temp\2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1424