Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 04:31
General
- Target 0e906c16f20779bcb800bbab284eb75e.exe
- Size 177KB
- Sample231230-e5r6ssgah5
- SHA256 7d42f8f7131f3ff51c17e8ace8040e4ea1645416509ce9e724ef25b39d24e1fc
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Registers COM server for autorun 1 TTPs 3 IoCs
- Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\0e906c16f20779bcb800bbab284eb75e.exe"C:\Users\Admin\AppData\Local\Temp\0e906c16f20779bcb800bbab284eb75e.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
n
memory/2916-6-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2916-2-0x0000000002040000-0x0000000002041000-memory.dmp
memory/2916-3-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2916-5-0x0000000002090000-0x0000000002091000-memory.dmp
memory/2916-4-0x0000000002050000-0x0000000002083000-memory.dmp
memory/2916-0-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2916-1-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2916-12-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2916-13-0x0000000002050000-0x0000000002083000-memory.dmp
memory/3492-7-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3492-14-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3492-15-0x0000000000400000-0x0000000000433000-memory.dmp