Analysis

  • max time kernel
    143s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-02-2023 15:11

General

  • Target

    Sons-Of-The-Forest-Hola-Browser-Setup-C-Mmdb1.exe

  • Size

    1.4MB

  • MD5

    0ae910eee527d508745f79d10762fdfb

  • SHA1

    e40557b1cbf21942c45c0462e1b24a1a83ef9e99

  • SHA256

    2b8235f92ed8e96ccd83e8a47428642f4d0599df496dc7c2d75772c3cc9d54cc

  • SHA512

    7ca24844010d5be334d78dbb808b60785a1b4e507425e94c840d4bdd30f2aea8a4821e309c9ed673291d952cfae29868e73b9adc5ad436a39691720fc8b71afa

  • SSDEEP

    24576:2nlwinUv+L8m657w6ZBLmkitKqBCjC0PDgM5A4woGHp:2nlyuVV1BCjBkJ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sons-Of-The-Forest-Hola-Browser-Setup-C-Mmdb1.exe
    "C:\Users\Admin\AppData\Local\Temp\Sons-Of-The-Forest-Hola-Browser-Setup-C-Mmdb1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\Sons-Of-The-Forest-Hola-Browser-Setup-C-Mmdb1.exe
      "C:\Users\Admin\AppData\Local\Temp\Sons-Of-The-Forest-Hola-Browser-Setup-C-Mmdb1.exe" --monitor 1884
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1288-142-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1288-141-0x0000000009880000-0x00000000098A2000-memory.dmp

    Filesize

    136KB

  • memory/1288-135-0x0000000005E10000-0x0000000005E66000-memory.dmp

    Filesize

    344KB

  • memory/1288-136-0x0000000006760000-0x0000000006798000-memory.dmp

    Filesize

    224KB

  • memory/1288-137-0x0000000006740000-0x000000000674E000-memory.dmp

    Filesize

    56KB

  • memory/1288-138-0x0000000006AA0000-0x0000000006AA8000-memory.dmp

    Filesize

    32KB

  • memory/1288-134-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1288-146-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1288-143-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1288-133-0x0000000000860000-0x00000000009C8000-memory.dmp

    Filesize

    1.4MB

  • memory/1288-140-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1288-145-0x0000000005330000-0x0000000005340000-memory.dmp

    Filesize

    64KB

  • memory/1476-144-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/1476-139-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB