Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
чичи пз/Extreme Injector v3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
чичи пз/Extreme Injector v3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
чичи пз/Prototype5/MinHook.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
чичи пз/Prototype5/MinHook.x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
чичи пз/Prototype5/Prototype5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
чичи пз/Prototype5/Prototype5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target чичи пз/Extreme Injector v3.exe
- Size 1.9MB
- Sample260727-x52pcach66
- SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
- MD5 ec801a7d4b72a288ec6c207bb9ff0131
- SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
- SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
- SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
- TLSH T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe 5232 Extreme Injector v3.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: SeDebugPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe Token: 33 5232 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 5232 Extreme Injector v3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\чичи пз\Extreme Injector v3.exe"C:\Users\Admin\AppData\Local\Temp\чичи пз\Extreme Injector v3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3460