Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    24-09-2021 18:21

General

  • Target

    DusBrowserInst.exe

  • Size

    172KB

  • MD5

    2bf65413a6aabdbb7f18b7efebee633d

  • SHA1

    c4eed75b2d69ca51ce87ede0a907db0ecbb4f4b7

  • SHA256

    1db05647c15a26167a50bf7cf1d5f2d00ae89e4f18cfba2bcb4024f043c81739

  • SHA512

    b59fcc75925273239c90520d616a9e5dddacfc36d6cefb1f464dab3ef066aebfc57adfd9e28484aadfb9ed6a9dde4d509e0eee2bc5245a795025c64fb790fb2f

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DusBrowserInst.exe
    "C:\Users\Admin\AppData\Local\Temp\DusBrowserInst.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3608-115-0x0000000000D50000-0x0000000000D51000-memory.dmp

    Filesize

    4KB

  • memory/3608-117-0x0000000001580000-0x0000000001581000-memory.dmp

    Filesize

    4KB

  • memory/3608-118-0x0000000001590000-0x00000000015AE000-memory.dmp

    Filesize

    120KB

  • memory/3608-119-0x00000000015B0000-0x00000000015B1000-memory.dmp

    Filesize

    4KB

  • memory/3608-120-0x000000001BB70000-0x000000001BB72000-memory.dmp

    Filesize

    8KB