Overview

overview

10

Static

static

9

db2b382587...10.exe

windows7_x64

10

db2b382587...10.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    134s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 13:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10.exe

  • Size

    690KB

  • MD5

    27612a1c9b24892d269a6dc74f52a969

  • SHA1

    c98dd2ca6c60055ceef283e2633f05ac1dcd27c9

  • SHA256

    db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10

  • SHA512

    34ea857eab0b068d707e89a6c1158bb68608241cd08a4896ea0d5219337f22739ccebc1e32f6b477ad7473e4b4ce24c3f8b75c64b1b8182edc1e548eef35fd31

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10.exe
    "C:\Users\Admin\AppData\Local\Temp\db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\SysWOW64\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\system32\FonDUE.EXE
        "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
        3⤵
          PID:2992
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3968
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:828

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3968-130-0x0000017BAE620000-0x0000017BAE630000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3968-131-0x0000017BAE680000-0x0000017BAE690000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3968-132-0x0000017BB0D30000-0x0000017BB0D34000-memory.dmp

      Filesize

      16KB

      Download