Analysis
-
max time kernel
120s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 07:22
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.6MB
-
MD5
372c27b8294da7fdb472a08ceb4db8f1
-
SHA1
27122520acebb507edac27212b61b0799acdc3da
-
SHA256
a95fcc8fcc95ac26001805bb0afe26633d6020d58c44533e17e3e9f1d62ab5ed
-
SHA512
d0076349398166d6692f2bb21896e7419eef5a3ae62ce58633bb6225a43e26b84f9ff80153a3673f890842fc810df62a68957406a3d17f4035a3ebe8900ef407
-
SSDEEP
49152:pPZCrE86CBVbsdBlBNshFOmpl/dp8WT9LJkA2A+gMSSf5XXvEUSyJ:1uE86CHKBlBNshFTl/dlT9LJkQlM7f5H
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
45.151.135.235 - Port:
21 - Username:
123 - Password:
123
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 1772 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 1772 tmp.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1772-136-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-135-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-137-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-138-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-140-0x0000000006720000-0x00000000067BC000-memory.dmpFilesize
624KB
-
memory/1772-141-0x0000000006D70000-0x0000000007314000-memory.dmpFilesize
5.6MB
-
memory/1772-142-0x0000000006830000-0x0000000006896000-memory.dmpFilesize
408KB
-
memory/1772-144-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-145-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-146-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/1772-147-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB