f1f3e9d0bcea30ca7beb1322cd888be2d0e00e5e419c5c6838aa2c63cadab65d

Analysis

max time kernel
123s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ce25bd2d78d12035999e15c77311edc.exe
Size 1.2MB
Sample240101-pws2vadfb5
SHA256 f1f3e9d0bcea30ca7beb1322cd888be2d0e00e5e419c5c6838aa2c63cadab65d
MD5 3ce25bd2d78d12035999e15c77311edc
SHA1 19e3ab4c48561655a7bdda82e8cb528465554996
SHA512 cdbc1602fe3fa0dcdeda87f36f992a4bc35c0ff59e64ce00423db7e73ffba5b9a32007d347581623793dacd5fa7e499f2f0f9a6827784db959db9ec631d0da02
SSDEEP 24576:jiS/d3PKzkstksYF6MdkmC9UUw200rCP0my8jhMN6ZN7Z:5KS6ykmC9UtG45iN6ZN7
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/1888-7-0x0000000005140000-0x0000000005152000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1888	3ce25bd2d78d12035999e15c77311edc.exe
1888	3ce25bd2d78d12035999e15c77311edc.exe
4552	3ce25bd2d78d12035999e15c77311edc.exe
4552	3ce25bd2d78d12035999e15c77311edc.exe
4552	3ce25bd2d78d12035999e15c77311edc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	3ce25bd2d78d12035999e15c77311edc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 3376	1888	3ce25bd2d78d12035999e15c77311edc.exe	102
PID 1888 wrote to memory of 3376	1888	3ce25bd2d78d12035999e15c77311edc.exe	102
PID 1888 wrote to memory of 3376	1888	3ce25bd2d78d12035999e15c77311edc.exe	102
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101
PID 1888 wrote to memory of 4552	1888	3ce25bd2d78d12035999e15c77311edc.exe	101

C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe
"C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe
  "C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe
  "C:\Users\Admin\AppData\Local\Temp\3ce25bd2d78d12035999e15c77311edc.exe"
  2⤵
  PID:3376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-1-0x00000000003F0000-0x000000000052E000-memory.dmp

Download

memory/1888-2-0x00000000054D0000-0x0000000005A74000-memory.dmp

Download

memory/1888-4-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/1888-6-0x0000000005190000-0x000000000522C000-memory.dmp

Download

memory/1888-5-0x00000000050E0000-0x00000000050EA000-memory.dmp

Download

memory/1888-3-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Download

memory/1888-0-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/1888-7-0x0000000005140000-0x0000000005152000-memory.dmp

Download

memory/1888-8-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/1888-9-0x0000000006010000-0x00000000060AA000-memory.dmp

Download

memory/1888-10-0x00000000084B0000-0x00000000084DE000-memory.dmp

Download

memory/1888-13-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4552-14-0x00000000016A0000-0x00000000019EA000-memory.dmp

Download

memory/4552-11-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4552-15-0x00000000016A0000-0x00000000019EA000-memory.dmp

Download