Resubmissions
22-01-2024 19:16
240122-xy3cascdgm 1015-11-2023 07:49
231115-jn5ssaed96 1013-11-2023 17:10
231113-vppczaef64 5Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2023 17:10
Static task
static1
Behavioral task
behavioral1
Sample
Punta.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Punta.exe
Resource
win10v2004-20231023-en
General
-
Target
Punta.exe
-
Size
1.0MB
-
MD5
f61d5fb45db0f9b6073f9e77d172bba3
-
SHA1
74d9aa7d3a56fc20145e83d33d8ed92a127fe382
-
SHA256
0cd962aba91336f6b82e54c35a7afa922981cfe776607cb2a2e1b072871fe2d1
-
SHA512
a0f7183cdbca71ec035e85626a9f9d0cd278597fd6a3c7262e30eb5cf77a8a2a14ea7d105ee5f51de9aa884575d67e52ca777fe80418cf1bfba4ee2030f3b46b
-
SSDEEP
24576:UkdMJtCwN/TZyUsxmFQHIxkxa4U6TrZV:UkkvR84FQHUEUEH
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Punta.exedescription pid process target process PID 3504 set thread context of 4148 3504 Punta.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 8 ipconfig.exe 2824 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 4148 SearchProtocolHost.exe 4148 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
Punta.exepid process 3504 Punta.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 916 whoami.exe Token: SeDebugPrivilege 2824 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Punta.exedescription pid process target process PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe PID 3504 wrote to memory of 4148 3504 Punta.exe SearchProtocolHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Punta.exe"C:\Users\Admin\AppData\Local\Temp\Punta.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all3⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3504-0-0x00000000008E0000-0x0000000000982000-memory.dmpFilesize
648KB
-
memory/3504-1-0x0000000000A60000-0x0000000000B27000-memory.dmpFilesize
796KB
-
memory/3504-6-0x0000000000A60000-0x0000000000B27000-memory.dmpFilesize
796KB
-
memory/4148-2-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB
-
memory/4148-4-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB
-
memory/4148-5-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB
-
memory/4148-7-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB
-
memory/4148-10-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB
-
memory/4148-22-0x00000000006B0000-0x00000000006FF000-memory.dmpFilesize
316KB