Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
07/11/2023, 14:04
General
-
Target
Evosoft.SailPlay/Microsoft.Extensions.DependencyInjection.Abstractions.dll
-
Size
35KB
-
MD5
1bc1277126655b767aa9e4cbc41bb5e6
-
SHA1
5e46b938639a28651bd4de8eda438ccc5a212e1c
-
SHA256
175dd59c6ef443c8350f5365db3ac262a2f72016d38e1abb304538dacbbe0918
-
SHA512
93c73ecbbbef595af6168457f0805b0b53d40cc126ce33efaa2a65b86d92c27e1b0d3a468f3619bbec70c990601c6d94c8556083cb33e85011c709d4162d665e
-
SSDEEP
384:23VVPJrgCcYGJiH4Dw/lbfQV460lER0+YUMiwEzITzW4PLWGaQHRN7Ot5ltV:CbPRgC4iHt9IVTBYMwEzIpJLOt7
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Evosoft.SailPlay\Microsoft.Extensions.DependencyInjection.Abstractions.dll,#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD58e023303dd94348adeb413172883fc89
SHA1fc42786b67ae43a172cd5bd4b9f843c34da41ddf
SHA25640b16d78a0e99960d352a2accd61fd9305741267eb2a83f715370d5a38d23fb5
SHA512c9acc6aad89ccf5eef789790ebb9867a6f19d64018e044dc8977be1d5dc1927f7b992327baa5b289c03fcd18ad486009fe7b251134855adef6059054d56266d0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB