120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e | Triage

Resubmissions

24/11/2022, 10:37

221124-mn9nhsgg76 1

24/11/2022, 10:33

221124-mlpwbsgf33 1

24/11/2022, 10:30

221124-mjs5zabe6s 1

24/11/2022, 10:26

221124-mg13ssgd25 1

Analysis

max time kernel
126s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:30

Sharing

Report Analysis Logs

General

Target

Server.exe
Size

150KB
MD5

0f367fce0c77e594ec09f105ded2503a
SHA1

fba1dd99300e2c9d574a4afa976590b6da35ee50
SHA256

120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e
SHA512

a8a6d855805f9e223478191577bbe981d09b988fdb20c64fa62431587b122424b2d868f82feaeb3e5be6e4aa49ccc3cf842c592ead2d8c645f497f1b69764f3f
SSDEEP

3072:+FhkwDd+B2lf1oJWT9RMkjWyqQuRN4GepKsqL4:+Pk0d+Bo6JWT93q9/4

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1684	1524	Server.exe	27
PID 1524 wrote to memory of 1684	1524	Server.exe	27
PID 1524 wrote to memory of 1684	1524	Server.exe	27
PID 1524 wrote to memory of 1684	1524	Server.exe	27

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  PID:1684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x180
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" shell32.dll,Options_RunDLL 0
1⤵
PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1524-57-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-58-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download