Analysis
- max time kernel
140s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
16/08/2023, 07:59
General
- Target 6a5ba8411f4ad53887f6de0e1c67fc3d1b055c40184535f8445123ece5799b9e.exe
- Size 4.9MB
- Sample230816-jvqmfagg72
- SHA256 6a5ba8411f4ad53887f6de0e1c67fc3d1b055c40184535f8445123ece5799b9e
Malware Config
Extracted
-
Protocol
ftp
-
Host
154.12.91.243
-
Port
21
-
Username
123
-
Password
123123
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a5ba8411f4ad53887f6de0e1c67fc3d1b055c40184535f8445123ece5799b9e.exe"C:\Users\Admin\AppData\Local\Temp\6a5ba8411f4ad53887f6de0e1c67fc3d1b055c40184535f8445123ece5799b9e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1948-135-0x00000000735A0000-0x0000000073D50000-memory.dmp
memory/1948-136-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-139-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-138-0x00000000057B0000-0x0000000005D54000-memory.dmp
memory/1948-137-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-141-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-142-0x00000000772E1000-0x00000000772E2000-memory.dmp
memory/1948-143-0x0000000006480000-0x0000000006512000-memory.dmp
memory/1948-144-0x0000000006540000-0x000000000654A000-memory.dmp
memory/1948-147-0x00000000067F0000-0x000000000688C000-memory.dmp
memory/1948-148-0x00000000068B0000-0x0000000006916000-memory.dmp
memory/1948-150-0x00000000735A0000-0x0000000073D50000-memory.dmp
memory/1948-151-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-152-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-153-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-154-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-155-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/1948-156-0x00000000034E0000-0x00000000034F0000-memory.dmp