Resubmissions
01-07-2024 19:19
240701-x1p5raydmj 10Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 19:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mQY9ka5sW6hv2Ri.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
mQY9ka5sW6hv2Ri.exe
-
Size
584KB
-
MD5
e97620420d37596704d9f4fa70303453
-
SHA1
533b98b289ba07c446f8350950fdbee2ab39dcf2
-
SHA256
a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
-
SHA512
a5ee774c492216568a9c16768cf83188cc261e1f4888cbe4aff9717bc13bccade2594ffe04bac35367213e8b3288e2671841320d529aa5f5a168e1756c6c7ed3
-
SSDEEP
12288:wanv6lRPM97SMRgqbFwWAEY/Z1NJQtUa2e0szSoMXGjxbFtACUYsOl7n9W1ei:5IRombqbFwWrYn7Q32e0GSUptACOOBn9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
mQY9ka5sW6hv2Ri.exepid process 1680 mQY9ka5sW6hv2Ri.exe 1680 mQY9ka5sW6hv2Ri.exe 1680 mQY9ka5sW6hv2Ri.exe 1680 mQY9ka5sW6hv2Ri.exe 1680 mQY9ka5sW6hv2Ri.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mQY9ka5sW6hv2Ri.exedescription pid process Token: SeDebugPrivilege 1680 mQY9ka5sW6hv2Ri.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
mQY9ka5sW6hv2Ri.exedescription pid process target process PID 1680 wrote to memory of 2280 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2280 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2280 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2280 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2116 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2116 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2116 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2116 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2376 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2376 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2376 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2376 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2124 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2124 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2124 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2124 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2656 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2656 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2656 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 1680 wrote to memory of 2656 1680 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmpFilesize
4KB
-
memory/1680-1-0x0000000000390000-0x0000000000426000-memory.dmpFilesize
600KB
-
memory/1680-2-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/1680-3-0x0000000000340000-0x0000000000350000-memory.dmpFilesize
64KB
-
memory/1680-4-0x0000000000580000-0x000000000058C000-memory.dmpFilesize
48KB
-
memory/1680-5-0x0000000004830000-0x00000000048A6000-memory.dmpFilesize
472KB
-
memory/1680-6-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB