1b8393aaaeaeec6922d4439fb770b404c8655732a551ad02deefc378e1412504

Analysis

max time kernel
0s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
01/01/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SysDriver.exe
Size

11.1MB
MD5

d0c392f052be1921b21e8770bbf7578e
SHA1

d1d09df2d1edcd218ad3b40a244966439e169971
SHA256

1b8393aaaeaeec6922d4439fb770b404c8655732a551ad02deefc378e1412504
SHA512

261f2bfa8eb0efb4d0bbeea64ab10af32e74616f5da2a19e408bd75d79270cec93f7d2971189fc9f65f559113a70fffcd6ba607cfaea2b0ec7fbf2f44df1e413
SSDEEP

98304:eypja0oeYASNbs1koljn0bdnOc+LT2ME63qrB4P:TjH1SJs1/ljn0bdnOc+LSl664P

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.amazonaws.com
6	checkip.amazonaws.com

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	SysDriver.exe
Token: 33	1760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1760	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	5068	wmic.exe
Token: SeSecurityPrivilege	5068	wmic.exe
Token: SeTakeOwnershipPrivilege	5068	wmic.exe
Token: SeLoadDriverPrivilege	5068	wmic.exe
Token: SeSystemProfilePrivilege	5068	wmic.exe
Token: SeSystemtimePrivilege	5068	wmic.exe
Token: SeProfSingleProcessPrivilege	5068	wmic.exe
Token: SeIncBasePriorityPrivilege	5068	wmic.exe
Token: SeCreatePagefilePrivilege	5068	wmic.exe
Token: SeBackupPrivilege	5068	wmic.exe
Token: SeRestorePrivilege	5068	wmic.exe
Token: SeShutdownPrivilege	5068	wmic.exe
Token: SeDebugPrivilege	5068	wmic.exe
Token: SeSystemEnvironmentPrivilege	5068	wmic.exe
Token: SeRemoteShutdownPrivilege	5068	wmic.exe
Token: SeUndockPrivilege	5068	wmic.exe
Token: SeManageVolumePrivilege	5068	wmic.exe
Token: 33	5068	wmic.exe
Token: 34	5068	wmic.exe
Token: 35	5068	wmic.exe
Token: 36	5068	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5068	4112	SysDriver.exe	69
PID 4112 wrote to memory of 5068	4112	SysDriver.exe	69

C:\Users\Admin\AppData\Local\Temp\SysDriver.exe
"C:\Users\Admin\AppData\Local\Temp\SysDriver.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:4976
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1384
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4112-4-0x0000000000630000-0x00000000011B5000-memory.dmp

Filesize
11.5MB

Download