Managed XDR

c-users-user-appdata-l...6c24cdba-zqa-email.eml — malware analysis report

File info

Filename
c-users-user-appdata-local-temp-gyoqztv4.3rx-sendmail-messages_package-09.x64_bind_inject_notepad-.7z-6df5a56f6c24cdba-zqa-email.eml
File type
RFC 822 mail, ASCII text, with CRLF line terminators
File size
10.2 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
8f838186932ab277c73f569bf031383c6d0a8618
SHA256
44ae2929cc7eb0e8adaef01f805b2e024b6a4e7ca5cf4ad54b9987014e2f1b73
MD5
0b9e2ebebb7a724621fdd7b0d881a30f

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
test_check_service: Starts services