Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 16:30
Behavioral task
behavioral1
Sample
92adfbe29d3ddd3afe816ca7e6f183bb.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
92adfbe29d3ddd3afe816ca7e6f183bb.dll
Resource
win10v2004-20231127-en
General
-
Target
92adfbe29d3ddd3afe816ca7e6f183bb.dll
-
Size
102KB
-
MD5
92adfbe29d3ddd3afe816ca7e6f183bb
-
SHA1
8e6868f4784fa663b11e7c2f17281e1aec48a84c
-
SHA256
27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50
-
SHA512
9a329727229d624241d14ab206219f2fad29125ec5fb2f1a332dd2832198382229eca03bdcf435563dcd3a121a8e96aa4648ea77704954a62bf4e88b6cdac68e
-
SSDEEP
3072:gWlRooD+MzxG2Mosm5quQR5yyrz7BUKBYW0Z:gc2l0RsIquQR5vdCW0Z
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 4988 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2664 wrote to memory of 4580 2664 rundll32.exe rundll32.exe PID 2664 wrote to memory of 4580 2664 rundll32.exe rundll32.exe PID 2664 wrote to memory of 4580 2664 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#12⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD50c853493f2908acf5fb34d44ec23e3e9
SHA12919632f0ba1fe8d51fa3c7004f666b71763e689
SHA2561739cc1da2effcc256005640bdcfc8b0e8c8f7580e5ff9424066cb2b2b99cca0
SHA51209c5efa8d922a178d3d32f026e0a842716a7d972c67417abdffc7ae8aa057767bc609fbb277b5727a545a400b317b71e0e7b581db45369f765c344301a334728
-
memory/4988-40-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-33-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-42-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-34-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-35-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-36-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-37-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-38-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-43-0x0000014268800000-0x0000014268801000-memory.dmpFilesize
4KB
-
memory/4988-0-0x0000014260540000-0x0000014260550000-memory.dmpFilesize
64KB
-
memory/4988-68-0x0000014268A50000-0x0000014268A51000-memory.dmpFilesize
4KB
-
memory/4988-32-0x0000014268BB0000-0x0000014268BB1000-memory.dmpFilesize
4KB
-
memory/4988-39-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB
-
memory/4988-44-0x00000142687F0000-0x00000142687F1000-memory.dmpFilesize
4KB
-
memory/4988-46-0x0000014268800000-0x0000014268801000-memory.dmpFilesize
4KB
-
memory/4988-49-0x00000142687F0000-0x00000142687F1000-memory.dmpFilesize
4KB
-
memory/4988-52-0x000001425FFF0000-0x000001425FFF1000-memory.dmpFilesize
4KB
-
memory/4988-16-0x0000014260640000-0x0000014260650000-memory.dmpFilesize
64KB
-
memory/4988-64-0x0000014268930000-0x0000014268931000-memory.dmpFilesize
4KB
-
memory/4988-66-0x0000014268940000-0x0000014268941000-memory.dmpFilesize
4KB
-
memory/4988-67-0x0000014268940000-0x0000014268941000-memory.dmpFilesize
4KB
-
memory/4988-41-0x0000014268BE0000-0x0000014268BE1000-memory.dmpFilesize
4KB