Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-05-2022 02:23
Static task
static1
Behavioral task
behavioral1
Sample
VLTKTanthuTN.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
VLTKTanthuTN.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
VLTKTanthuTN.exe
-
Size
1.7MB
-
MD5
72ae1ef77048260282b4e791eede5e3c
-
SHA1
1cfdba9ef625ddaaf525d033eca45359511a7113
-
SHA256
431ec8528e6344c0abf90147e86180ba16c3bbeb6ef70786c66c0d4044ef82a2
-
SHA512
bdb021cedfa95688f5bf3189dbf4cdf438fe2ccf38e2f2281e61b94d07551f70f1f73b10f4f0a57270065cf3a662b13ee82d518522c265947b3dcf40fc351c69
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
VLTKTanthuTN.exedescription ioc process File opened for modification \??\PhysicalDrive0 VLTKTanthuTN.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
VLTKTanthuTN.exepid process 4644 VLTKTanthuTN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
VLTKTanthuTN.exedescription pid process Token: SeDebugPrivilege 4644 VLTKTanthuTN.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
VLTKTanthuTN.exepid process 4644 VLTKTanthuTN.exe 4644 VLTKTanthuTN.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4644-130-0x0000000000240000-0x00000000003F4000-memory.dmpFilesize
1.7MB
-
memory/4644-131-0x000000000AA20000-0x000000000AFC4000-memory.dmpFilesize
5.6MB
-
memory/4644-132-0x000000000A510000-0x000000000A5A2000-memory.dmpFilesize
584KB
-
memory/4644-133-0x000000000A6B0000-0x000000000A6BA000-memory.dmpFilesize
40KB