Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
26/12/2023, 12:05
General
- Target 6d1d347586fc6bb98e47ed63bced4be0.exe
- Size 281KB
- Sample231226-n9bjaaaae5
- SHA256 05ababa837a7d4a18ac1dddf379b5a0cb846399e30ae90baa3d71334525c37b5
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d1d347586fc6bb98e47ed63bced4be0.exe"C:\Users\Admin\AppData\Local\Temp\6d1d347586fc6bb98e47ed63bced4be0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsn422B.tmp\installer.exeC:\Users\Admin\AppData\Local\Temp\nsn422B.tmp\installer.exe 4f75e8eb-a354-4d3f-844a-77895bc06f2f.exe /t /dT132190409S /e9860309 /u4f75e8eb-a354-4d3f-844a-77895bc06f2f2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\nsn422B.tmp\4f75e8eb-a354-4d3f-844a-77895bc06f2f.exe/t /dT132190409S /e9860309 /u4f75e8eb-a354-4d3f-844a-77895bc06f2f1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
installer.exe
nsExec.dll
memory/1844-22-0x0000000001110000-0x0000000001120000-memory.dmp
memory/1844-26-0x0000000074BF0000-0x00000000751A1000-memory.dmp
memory/1844-20-0x0000000001110000-0x0000000001120000-memory.dmp
memory/1844-21-0x0000000074BF0000-0x00000000751A1000-memory.dmp
memory/1844-19-0x0000000074BF0000-0x00000000751A1000-memory.dmp
memory/1844-24-0x0000000001110000-0x0000000001120000-memory.dmp
memory/1844-23-0x0000000001110000-0x0000000001120000-memory.dmp
memory/2248-32-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4964-10-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/4964-9-0x00007FFEBDEF0000-0x00007FFEBE891000-memory.dmp
memory/4964-14-0x00007FFEBDEF0000-0x00007FFEBE891000-memory.dmp
memory/4964-28-0x00007FFEBDEF0000-0x00007FFEBE891000-memory.dmp
memory/4964-11-0x000000001BD40000-0x000000001BD68000-memory.dmp