Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12-10-2023 13:16
General
-
Target
a499bc2a35f4e01110acfbd7fa2b65ab92ebac6c82f444b4c76ab7958de88a00.exe
-
Size
67KB
-
MD5
03df22a68013c5d442787000e72b15f0
-
SHA1
6258530ca3e9ba5c7f3198db4170495ec6a2a14b
-
SHA256
a499bc2a35f4e01110acfbd7fa2b65ab92ebac6c82f444b4c76ab7958de88a00
-
SHA512
d5a44a50b4a3813eda7d0a2dbfe18fe5a464c2ee34454319d2cfeaa46da59d3b9efb013a335b2613d28e4d9767b633fc8f88ff2b2acc747585d9d7df0846bd89
-
SSDEEP
768:q2XwwfJJj4JkuD3XMwseD2qwZ0WggCXG7quQK9HmBqj+i2kv+DzDM77+uMKbMH7E:X5JJjunzEC2uYsPhqRkI7yax
Score
10/10
Malware Config
Signatures
-
Ploutus
Ploutus is an ATM malware written in C#.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a499bc2a35f4e01110acfbd7fa2b65ab92ebac6c82f444b4c76ab7958de88a00.exe"C:\Users\Admin\AppData\Local\Temp\a499bc2a35f4e01110acfbd7fa2b65ab92ebac6c82f444b4c76ab7958de88a00.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1312-0-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/1312-1-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/1312-2-0x0000000000A80000-0x0000000000AC0000-memory.dmpFilesize
256KB
-
memory/1312-3-0x0000000000A80000-0x0000000000AC0000-memory.dmpFilesize
256KB
-
memory/1312-7-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/1312-8-0x0000000000A80000-0x0000000000AC0000-memory.dmpFilesize
256KB
-
memory/1312-9-0x0000000000A80000-0x0000000000AC0000-memory.dmpFilesize
256KB