Analysis
- max time kernel
120s - max time network
137s - platform
windows7_x64 - resource
win7-20231023-en - resource tags
- submitted
27/11/2023, 02:55
General
- Target 3434882067653dc2b67b235ff3ae4f71d912d4d601dda76da22f22fd9b6907cf.exe
- Size 165.8MB
- Sample231127-der8fadh4w
- SHA256 3434882067653dc2b67b235ff3ae4f71d912d4d601dda76da22f22fd9b6907cf
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3434882067653dc2b67b235ff3ae4f71d912d4d601dda76da22f22fd9b6907cf.exe"C:\Users\Admin\AppData\Local\Temp\3434882067653dc2b67b235ff3ae4f71d912d4d601dda76da22f22fd9b6907cf.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
PresentationNative_cor3.dll
vcruntime140_cor3.dll
memory/1576-43-0x0000000003E30000-0x0000000003E40000-memory.dmp
memory/1576-47-0x0000000003E40000-0x0000000003E60000-memory.dmp
memory/1576-19-0x0000000002470000-0x00000000025D0000-memory.dmp
memory/1576-23-0x0000000001E20000-0x0000000001E70000-memory.dmp
memory/1576-27-0x0000000000130000-0x0000000000170000-memory.dmp
memory/1576-31-0x0000000007090000-0x00000000078D0000-memory.dmp
memory/1576-35-0x00000000078D0000-0x0000000007950000-memory.dmp
memory/1576-39-0x0000000000320000-0x0000000000330000-memory.dmp
memory/1576-6-0x0000000003280000-0x0000000003DA0000-memory.dmp
memory/1576-15-0x0000000006440000-0x0000000006670000-memory.dmp
memory/1576-51-0x00000000041B0000-0x00000000041D0000-memory.dmp
memory/1576-59-0x0000000004270000-0x00000000042B0000-memory.dmp
memory/1576-55-0x0000000004200000-0x0000000004220000-memory.dmp
memory/1576-63-0x00000000042E0000-0x0000000004300000-memory.dmp
memory/1576-67-0x00000000066B0000-0x00000000066E0000-memory.dmp
memory/1576-10-0x0000000005290000-0x0000000006210000-memory.dmp
memory/1576-11-0x000000013F390000-0x000000013FCD0000-memory.dmp
memory/1576-108-0x000000013F390000-0x000000013FCD0000-memory.dmp