Resubmissions

16/07/2023, 23:25

230716-3epvrahb54 6

16/07/2023, 23:19

230716-3a3k2shh7v 6

Analysis

  • max time kernel
    16s
  • max time network
    23s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2023, 23:25

General

  • Target

    ServerCrasher.exe

  • Size

    78KB

  • MD5

    5cf22ad7c4d3ab44ba72fd6642aa643a

  • SHA1

    31601a86aadbc370be0b3fa92f583b56ec20381d

  • SHA256

    2fa42459e3f9fcc0d84bbfbef1ac65b8f2c2c16d2b7b3d7f3a30d5c9b93d6e35

  • SHA512

    2c38548b000b119a104e97dfdc478e24596f96b5a57e8295b7eff2a3bffda5ef6db48b0f95692f339b4e722b27f6dfb62c8ad71ea36d8f4a1e57509a611282e7

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIC:5Zv5PDwbjNrmAE+zIC

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ServerCrasher.exe
    "C:\Users\Admin\AppData\Local\Temp\ServerCrasher.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3992-133-0x000001F6857A0000-0x000001F6857B8000-memory.dmp

    Filesize

    96KB

  • memory/3992-134-0x000001F69FE10000-0x000001F69FFD2000-memory.dmp

    Filesize

    1.8MB

  • memory/3992-135-0x00007FFA30A00000-0x00007FFA314C1000-memory.dmp

    Filesize

    10.8MB

  • memory/3992-136-0x000001F69FCE0000-0x000001F69FCF0000-memory.dmp

    Filesize

    64KB

  • memory/3992-137-0x000001F6A0650000-0x000001F6A0B78000-memory.dmp

    Filesize

    5.2MB

  • memory/3992-138-0x00007FFA30A00000-0x00007FFA314C1000-memory.dmp

    Filesize

    10.8MB

  • memory/3992-139-0x000001F69FCE0000-0x000001F69FCF0000-memory.dmp

    Filesize

    64KB