Analysis
-
max time kernel
32s -
max time network
26s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13-10-2023 13:08
General
-
Target
dropper_cs.exe
-
Size
18KB
-
MD5
54628e3d4956efcbce04ebdd20eb5342
-
SHA1
9cfbec77418ef8572619928e055331a62ea31eee
-
SHA256
a51a7662d835e2db5159392b104f7e30cfa931341d3bf7c30d5667c7c2b3397f
-
SHA512
796d014f8eedf2a056ada9ade04fdd0e147e199f9c01e7a11c15d5cf4f561be4da7fd12d859e17239d77919cf7162081be6f1015bb26227ab23adf8c9cf1eb7b
-
SSDEEP
384:mR1O1HfA6c76wQ/J1O95acb43vK4oTb7VnwbN/4wy/jKXuQT:oY1YUBcfVneGrKXHT
Score
10/10
Malware Config
Signatures
-
PoshC2
Penetration testers toolkit for redteam.
-
PoshC2 binary 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper_cs.exe"C:\Users\Admin\AppData\Local\Temp\dropper_cs.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2272-0-0x0000000001080000-0x000000000108A000-memory.dmpFilesize
40KB
-
memory/2272-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmpFilesize
9.9MB
-
memory/2272-2-0x000000001ABE0000-0x000000001AC60000-memory.dmpFilesize
512KB
-
memory/2272-3-0x000007FEF5710000-0x000007FEF60FC000-memory.dmpFilesize
9.9MB
-
memory/2272-4-0x000000001ABE0000-0x000000001AC60000-memory.dmpFilesize
512KB