Analysis

  • max time kernel
    193s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 09:03

General

  • Target

    4349fd2a567910cdc4e5bf7dd8dc1e77.exe

  • Size

    290KB

  • MD5

    4349fd2a567910cdc4e5bf7dd8dc1e77

  • SHA1

    eb1bcfd3dbdc4dd79628a1bda93cb17de1d58146

  • SHA256

    e56cb91a892a507a5249cfb1e44e1252ac277e5f19dd7ec951f537b9746ec7c1

  • SHA512

    951a1c25a351332ed3579b6b75bac5fd5aa96f82dc8faf7af8044c3859966e706721a9fcd06f7741554f02f8a3f6420800d0da32519545a3da83be10954c86f0

  • SSDEEP

    6144:qGXfXPX/XarFuy+4UKtcm7osj7l4lKWbBTg/0+mQHoc:DXfXPX/XarFjoKJWFTgIQHD

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4349fd2a567910cdc4e5bf7dd8dc1e77.exe
    "C:\Users\Admin\AppData\Local\Temp\4349fd2a567910cdc4e5bf7dd8dc1e77.exe"
    1⤵
    • Loads dropped DLL
    PID:4700
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2f4 0x304
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    33KB

    MD5

    e4ec57e8508c5c4040383ebe6d367928

    SHA1

    b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

    SHA256

    8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

    SHA512

    77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

  • memory/4700-9-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-4-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-6-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-7-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-8-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-0-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4700-10-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-11-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-12-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-13-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-14-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/4700-15-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB