Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23-10-2023 20:10
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.76b265b24aa1662ba9c0051068da11c0_JC.exe
Resource
win7-20231020-en
General
-
Target
NEAS.76b265b24aa1662ba9c0051068da11c0_JC.exe
-
Size
6.5MB
-
MD5
76b265b24aa1662ba9c0051068da11c0
-
SHA1
5db9546faf0f8da703d02ad17765f6cda2ef89c4
-
SHA256
05c59a08729fd1bf54f815eb85d39c7d3815dc9d80b65c9d08b753f8891fe6db
-
SHA512
cd203ca17e227fb4cc4cf3fb9424e365edf0e4faf2aa9fe4ca71c8265b99afbf1fd2ebb6bd8254f774309ac99858dd310247f7ed2ad316154eb88a60e3f537c8
-
SSDEEP
196608:mdkkrmgC/BqfL+m7eSKSpE3cTrgP09ZcZ0j:7kr4sfCm7ergEkgPdq
Malware Config
Signatures
-
Detected Ploutus loader 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-4-0x0000000005EE0000-0x00000000068B4000-memory.dmp family_ploutus behavioral1/memory/2264-5-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-6-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-8-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-10-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-12-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-14-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-16-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-18-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-20-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-22-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-24-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-26-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-28-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-31-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-33-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-35-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-37-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-40-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-42-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-44-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-47-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-49-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-51-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-54-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-56-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-58-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-60-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-62-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-64-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-66-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-68-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-70-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus behavioral1/memory/2264-72-0x0000000005EE0000-0x00000000068AF000-memory.dmp family_ploutus -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.76b265b24aa1662ba9c0051068da11c0_JC.exedescription pid process Token: SeDebugPrivilege 2264 NEAS.76b265b24aa1662ba9c0051068da11c0_JC.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2264-0-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/2264-1-0x0000000005EA0000-0x0000000005EE0000-memory.dmpFilesize
256KB
-
memory/2264-2-0x00000000068C0000-0x0000000007296000-memory.dmpFilesize
9.8MB
-
memory/2264-3-0x0000000005EA0000-0x0000000005EE0000-memory.dmpFilesize
256KB
-
memory/2264-4-0x0000000005EE0000-0x00000000068B4000-memory.dmpFilesize
9.8MB
-
memory/2264-5-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-6-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-8-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-10-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-12-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-14-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-16-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-18-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-20-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-22-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-24-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-26-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-28-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-29-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/2264-31-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-33-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-35-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-37-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-39-0x0000000005EA0000-0x0000000005EE0000-memory.dmpFilesize
256KB
-
memory/2264-40-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-42-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-44-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-46-0x0000000005EA0000-0x0000000005EE0000-memory.dmpFilesize
256KB
-
memory/2264-47-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-49-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-52-0x0000000005EA0000-0x0000000005EE0000-memory.dmpFilesize
256KB
-
memory/2264-51-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-54-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-56-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-58-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-60-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-62-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-64-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-66-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-68-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-70-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB
-
memory/2264-72-0x0000000005EE0000-0x00000000068AF000-memory.dmpFilesize
9.8MB