Analysis
-
max time kernel
148s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 11:36
Static task
static1
Behavioral task
behavioral1
Sample
3cbedd47c006d4d2c86ee77eb7fde7d8.exe
Resource
win7-20231215-en
General
-
Target
3cbedd47c006d4d2c86ee77eb7fde7d8.exe
-
Size
364KB
-
MD5
3cbedd47c006d4d2c86ee77eb7fde7d8
-
SHA1
3e924dc1409ac54e0d3c096addb77a5bc516671b
-
SHA256
e34879d783a6d0d0bd71e9bd70b911c31a33e60c6bfae4c5c8687d9e3d3a56fa
-
SHA512
421d01605befc03fd033211c381cf069ab0db39c954ceb5d6a02d93e3f5d9dd8d175adc9bd13e36dd3af1a7317f3c6b4469d92f09fec27d52875b8b4508a3636
-
SSDEEP
6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6AN6:WBOO3VKID90TBEhx4O6a6
Malware Config
Signatures
-
Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/4272-3-0x0000000002260000-0x0000000002292000-memory.dmp dave behavioral2/memory/4272-6-0x0000000000720000-0x0000000000750000-memory.dmp dave -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3cbedd47c006d4d2c86ee77eb7fde7d8.exepid process 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 3288 wermgr.exe Token: SeDebugPrivilege 3288 wermgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3cbedd47c006d4d2c86ee77eb7fde7d8.exedescription pid process target process PID 4272 wrote to memory of 3288 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe wermgr.exe PID 4272 wrote to memory of 3288 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe wermgr.exe PID 4272 wrote to memory of 3288 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe wermgr.exe PID 4272 wrote to memory of 3288 4272 3cbedd47c006d4d2c86ee77eb7fde7d8.exe wermgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cbedd47c006d4d2c86ee77eb7fde7d8.exe"C:\Users\Admin\AppData\Local\Temp\3cbedd47c006d4d2c86ee77eb7fde7d8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3288-75-0x000002656DC00000-0x000002656DC24000-memory.dmpFilesize
144KB
-
memory/3288-77-0x000002656DC00000-0x000002656DC24000-memory.dmpFilesize
144KB
-
memory/4272-3-0x0000000002260000-0x0000000002292000-memory.dmpFilesize
200KB
-
memory/4272-6-0x0000000000720000-0x0000000000750000-memory.dmpFilesize
192KB
-
memory/4272-9-0x00000000022A0000-0x00000000022CE000-memory.dmpFilesize
184KB
-
memory/4272-8-0x00000000022E0000-0x000000000230F000-memory.dmpFilesize
188KB
-
memory/4272-10-0x00000000022E0000-0x000000000230F000-memory.dmpFilesize
188KB
-
memory/4272-72-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/4272-73-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/4272-74-0x00000000022E0000-0x000000000230F000-memory.dmpFilesize
188KB
-
memory/4272-76-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB