Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
29/09/2023, 03:16
General
- Target 2c700ee40c94d0326a17d64d920c4c9ca5f2ae43c70a354efd043cd45e0a979d.exe
- Size 1.5MB
- Sample230929-dsfrkagh94
- SHA256 2c700ee40c94d0326a17d64d920c4c9ca5f2ae43c70a354efd043cd45e0a979d
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c700ee40c94d0326a17d64d920c4c9ca5f2ae43c70a354efd043cd45e0a979d.exe"C:\Users\Admin\AppData\Local\Temp\2c700ee40c94d0326a17d64d920c4c9ca5f2ae43c70a354efd043cd45e0a979d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2576-48-0x000002331DF40000-0x000002331DF50000-memory.dmp
memory/2576-68-0x0000023326370000-0x0000023326371000-memory.dmp
memory/2576-67-0x0000023326260000-0x0000023326261000-memory.dmp
memory/2576-66-0x0000023326260000-0x0000023326261000-memory.dmp
memory/2576-64-0x0000023326230000-0x0000023326231000-memory.dmp
memory/4688-8-0x0000021775EE0000-0x0000021775EEE000-memory.dmp
memory/4688-30-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-7-0x0000021775F10000-0x0000021775F48000-memory.dmp
memory/4688-0-0x000002176F960000-0x000002176F994000-memory.dmp
memory/4688-21-0x00007FFA5A0F0000-0x00007FFA5ABB1000-memory.dmp
memory/4688-22-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-23-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-24-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-25-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-26-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-27-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-28-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-29-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-6-0x0000021775E90000-0x0000021775E98000-memory.dmp
memory/4688-31-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-5-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-4-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-3-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-2-0x0000021770370000-0x0000021770380000-memory.dmp
memory/4688-1-0x00007FFA5A0F0000-0x00007FFA5ABB1000-memory.dmp
memory/4688-69-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-70-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-71-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-72-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-73-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-74-0x0000021771B90000-0x0000021771D87000-memory.dmp
memory/4688-76-0x0000021771B90000-0x0000021771D87000-memory.dmp