c071c0232917e0234be096d059852c6e35d27b2d9515b712907c8d16837506d0 | Triage

Analysis

max time kernel
1590s
max time network
1735s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/05/2023, 00:02

Sharing

Report Analysis Logs

General

Target

GalacticFortress.exe
Size

651KB
MD5

b746ec336a45656a92d61da9c3816b05
SHA1

28f48c6dcccedd34f4b7dca393a0aba446f0d3f4
SHA256

4c48c5a35cf17c0fb3c05864681f7ed59728b7a51cd87940e92136e99ef4ac13
SHA512

a33b11f03ab250096f427824b3c5bfe0a384dfd1aca7f25b487d90a3b189879b3d08133d5007c2f30a1394fc2695bae591f38de0905ae96e6ef16141ae183b72
SSDEEP

3072:JQJ/VdFgIW9mYucJ/OD8JlsI90TIC7G2E1:a/7FG9mpcJ/OD8h/

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1404	AUDIODG.EXE
Token: 33	1404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1404	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	GalacticFortress.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2036	1036	GalacticFortress.exe	27
PID 1036 wrote to memory of 2036	1036	GalacticFortress.exe	27
PID 1036 wrote to memory of 2036	1036	GalacticFortress.exe	27

C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe
"C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 1036 1576960
  2⤵
  PID:2036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x57c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-68-0x000007FFFFEC0000-0x000007FFFFED0000-memory.dmp

Filesize
64KB

Download
memory/1036-85-0x000007FFFFEB0000-0x000007FFFFEC0000-memory.dmp

Filesize
64KB

Download