Analysis
-
max time kernel
147s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 13:08
General
-
Target
dropper_cs.exe
-
Size
18KB
-
MD5
54628e3d4956efcbce04ebdd20eb5342
-
SHA1
9cfbec77418ef8572619928e055331a62ea31eee
-
SHA256
a51a7662d835e2db5159392b104f7e30cfa931341d3bf7c30d5667c7c2b3397f
-
SHA512
796d014f8eedf2a056ada9ade04fdd0e147e199f9c01e7a11c15d5cf4f561be4da7fd12d859e17239d77919cf7162081be6f1015bb26227ab23adf8c9cf1eb7b
-
SSDEEP
384:mR1O1HfA6c76wQ/J1O95acb43vK4oTb7VnwbN/4wy/jKXuQT:oY1YUBcfVneGrKXHT
Score
10/10
Malware Config
Signatures
-
PoshC2
Penetration testers toolkit for redteam.
-
PoshC2 binary 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper_cs.exe"C:\Users\Admin\AppData\Local\Temp\dropper_cs.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4816-0-0x0000000000B00000-0x0000000000B0A000-memory.dmpFilesize
40KB
-
memory/4816-1-0x00007FFA5D380000-0x00007FFA5DE41000-memory.dmpFilesize
10.8MB
-
memory/4816-2-0x000000001B800000-0x000000001B810000-memory.dmpFilesize
64KB
-
memory/4816-3-0x00007FFA5D380000-0x00007FFA5DE41000-memory.dmpFilesize
10.8MB
-
memory/4816-4-0x000000001B800000-0x000000001B810000-memory.dmpFilesize
64KB