1201469326d088b1430565ab4cad384dce54bf3c8d20961167a343706b80051d

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

231c04816b08ed4fe5699fcbb0a25dd3.exe
Size

877KB
MD5

231c04816b08ed4fe5699fcbb0a25dd3
SHA1

52ecf5d223816cc5af6dc37208a7e81cb931f150
SHA256

1201469326d088b1430565ab4cad384dce54bf3c8d20961167a343706b80051d
SHA512

a6eb622d71868c2135473b10687d86d5e436a73b4b481125fc3eaf2601a9f8f57ee86b8238a1b97b009fae82593f67317b79e09466402c76effb56cd05da5d19
SSDEEP

24576:GoMLKmtvPyHu780y/4S1y9pNg4W7HMcKcN+2QHCUW:FiKmHyOWp7sc/Qw

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe
1728	231c04816b08ed4fe5699fcbb0a25dd3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	231c04816b08ed4fe5699fcbb0a25dd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 644	1388	231c04816b08ed4fe5699fcbb0a25dd3.exe	57
PID 1388 wrote to memory of 644	1388	231c04816b08ed4fe5699fcbb0a25dd3.exe	57
PID 1388 wrote to memory of 644	1388	231c04816b08ed4fe5699fcbb0a25dd3.exe	57
PID 644 wrote to memory of 1728	644	231c04816b08ed4fe5699fcbb0a25dd3.exe	58
PID 644 wrote to memory of 1728	644	231c04816b08ed4fe5699fcbb0a25dd3.exe	58
PID 644 wrote to memory of 1728	644	231c04816b08ed4fe5699fcbb0a25dd3.exe	58

C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe
"C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe
  "C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe
    "C:\Users\Admin\AppData\Local\Temp\231c04816b08ed4fe5699fcbb0a25dd3.exe"
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-7-0x0000000000630000-0x0000000000646000-memory.dmp

Filesize
88KB

Download
memory/1728-14-0x0000000002130000-0x0000000002166000-memory.dmp

Filesize
216KB

Download
memory/1728-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1728-22-0x000000007FE30000-0x000000007FE40000-memory.dmp

Filesize
64KB

Download
memory/1728-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1728-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1728-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1728-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1728-28-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download