Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 22:43
Static task
static1
Behavioral task
behavioral1
Sample
VLTKTanthuTN.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
VLTKTanthuTN.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
VLTKTanthuTN.exe
-
Size
1.7MB
-
MD5
72ae1ef77048260282b4e791eede5e3c
-
SHA1
1cfdba9ef625ddaaf525d033eca45359511a7113
-
SHA256
431ec8528e6344c0abf90147e86180ba16c3bbeb6ef70786c66c0d4044ef82a2
-
SHA512
bdb021cedfa95688f5bf3189dbf4cdf438fe2ccf38e2f2281e61b94d07551f70f1f73b10f4f0a57270065cf3a662b13ee82d518522c265947b3dcf40fc351c69
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
VLTKTanthuTN.exedescription ioc process File opened for modification \??\PhysicalDrive0 VLTKTanthuTN.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
VLTKTanthuTN.exepid process 2832 VLTKTanthuTN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
VLTKTanthuTN.exedescription pid process Token: SeDebugPrivilege 2832 VLTKTanthuTN.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
VLTKTanthuTN.exepid process 2832 VLTKTanthuTN.exe 2832 VLTKTanthuTN.exe 2832 VLTKTanthuTN.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2832-130-0x0000000000500000-0x00000000006B4000-memory.dmpFilesize
1.7MB
-
memory/2832-131-0x000000000AB40000-0x000000000B0E4000-memory.dmpFilesize
5.6MB
-
memory/2832-132-0x000000000A7D0000-0x000000000A862000-memory.dmpFilesize
584KB
-
memory/2832-133-0x000000000A960000-0x000000000A96A000-memory.dmpFilesize
40KB