Overview

overview

10

Static

static

core.bat

windows7_x64

10

core.bat

windows10-2004_x64

10

grunt_64.dll

windows7_x64

1

grunt_64.dll

windows10-2004_x64

4

Resubmissions

22-02-2022 16:11

220222-tmycesahb3 10

22-02-2022 16:10

220222-tmvxasbhfm 10

17-02-2022 17:57

220217-wj3h3scgd9 10

17-02-2022 15:34

220217-sz1gwacehj 10

Analysis

  • max time kernel
    136s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    17-02-2022 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    grunt_64.dll

  • Size

    570KB

  • MD5

    35295c028c8428948a92043156679447

  • SHA1

    a8ab397f5d7e50ddddde8923af0b57e68adee9bb

  • SHA256

    3f5d8249fb461ab74dfe7d88a7c5f1f2e46521a8c02173767ec3e02c990a723a

  • SHA512

    471447f23291fcf12930d2b533de60dc29453315414ea29b46d092d908d72d990fce3c5f541d1b47eaa96c16c8b197c8280cc52ad978c57b4e3066fff4b8bfb4

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\grunt_64.dll,#1
    1⤵
      PID:1128
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2436
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:836

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1128-136-0x00000176D1850000-0x00000176D1856000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2436-133-0x0000016D40360000-0x0000016D40370000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2436-134-0x0000016D40920000-0x0000016D40930000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2436-135-0x0000016D42FE0000-0x0000016D42FE4000-memory.dmp

      Filesize

      16KB

      Download