Analysis
- max time kernel
141s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
19/09/2023, 13:09
General
- Target 443837af8359003ab23d9f54f817e560.exe
- Size 168KB
- Sample230919-qdr79sbb84
- SHA256 f031fa03b61bd7a49d1500d642e46b4701c6ed40f34a3dc063c4404c7fd5de95
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\443837af8359003ab23d9f54f817e560.exe"C:\Users\Admin\AppData\Local\Temp\443837af8359003ab23d9f54f817e560.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\443837af8359003ab23d9f54f817e560.exeC:\Users\Admin\AppData\Local\Temp\443837af8359003ab23d9f54f817e560.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/380-0-0x0000000000030000-0x000000000005E000-memory.dmp
memory/380-1-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/380-2-0x0000000004B20000-0x0000000004B30000-memory.dmp
memory/380-3-0x0000000005B20000-0x0000000005B94000-memory.dmp
memory/380-4-0x0000000005C90000-0x0000000005CF2000-memory.dmp
memory/380-5-0x0000000005DC0000-0x0000000005E0C000-memory.dmp
memory/380-6-0x00000000063E0000-0x0000000006984000-memory.dmp
memory/380-10-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/3968-8-0x0000000000400000-0x000000000043A000-memory.dmp
memory/3968-11-0x0000000001740000-0x0000000001A8A000-memory.dmp
memory/3968-12-0x0000000000400000-0x000000000043A000-memory.dmp