Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 05:16

General

  • Target

    29a26edcd61d00d240cb2b7334d14131.exe

  • Size

    17.6MB

  • MD5

    29a26edcd61d00d240cb2b7334d14131

  • SHA1

    5aafa979424339ffbec58661f044f8d0c73aa545

  • SHA256

    0e3e7f87385f74fd184798f3428482595f3065ff8919bf33beeb6e31c57a84e5

  • SHA512

    363745401275eee956bde0b646c962b1a50683c817205f2e33e42f34836362518822438dcf63e2ccdb1bdbbf78be1e8505f36657da2063ef53afd301ca06511d

  • SSDEEP

    393216:tg0X0FTpukcMyIRMLBTIo661372/op0+8BVy5J70gjQOTJAZ8sa:tg0XkMqPGlt372/oa+8BViJ7NjQSg

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29a26edcd61d00d240cb2b7334d14131.exe
    "C:\Users\Admin\AppData\Local\Temp\29a26edcd61d00d240cb2b7334d14131.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2976-0-0x0000000074990000-0x0000000075140000-memory.dmp

    Filesize

    7.7MB

  • memory/2976-1-0x00000000004F0000-0x0000000001698000-memory.dmp

    Filesize

    17.7MB

  • memory/2976-2-0x00000000039F0000-0x00000000039FC000-memory.dmp

    Filesize

    48KB

  • memory/2976-3-0x00000000060D0000-0x00000000060E0000-memory.dmp

    Filesize

    64KB

  • memory/2976-4-0x00000000768A0000-0x0000000076990000-memory.dmp

    Filesize

    960KB

  • memory/2976-9-0x0000000007DE0000-0x0000000008384000-memory.dmp

    Filesize

    5.6MB

  • memory/2976-10-0x0000000007710000-0x00000000077A2000-memory.dmp

    Filesize

    584KB

  • memory/2976-11-0x00000000060D0000-0x00000000060E0000-memory.dmp

    Filesize

    64KB

  • memory/2976-12-0x00000000076D0000-0x00000000076DA000-memory.dmp

    Filesize

    40KB

  • memory/2976-16-0x00000000768A0000-0x0000000076990000-memory.dmp

    Filesize

    960KB

  • memory/2976-15-0x0000000074990000-0x0000000075140000-memory.dmp

    Filesize

    7.7MB