1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
17s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Size

762KB
MD5

3e9a543b85c85a0b808902b0b6cef9b2
SHA1

29d589b838b4e1a5e54a6bfe52da0d5859609865
SHA256

1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695
SHA512

f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6
SSDEEP

12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

description	pid	process	target process
PID 2772 set thread context of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

pid	process
2036	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
2036	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

description pid process

Token: SeDebugPrivilege 2036 1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

description	pid	process
Token: SeDebugPrivilege	2036	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

description	pid	process	target process
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
PID 2772 wrote to memory of 2036	2772	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe	1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe

C:\Users\Admin\AppData\Local\Temp\Samples 1\1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\Samples 1\1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2036-19-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2036-18-0x00000000067A0000-0x00000000067F0000-memory.dmp

Filesize
320KB

Download
memory/2036-14-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2036-16-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/2036-17-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2772-4-0x0000000005A00000-0x0000000005D54000-memory.dmp

Filesize
3.3MB

Download
memory/2772-7-0x0000000006510000-0x000000000651E000-memory.dmp

Filesize
56KB

Download
memory/2772-8-0x0000000006520000-0x000000000652A000-memory.dmp

Filesize
40KB

Download
memory/2772-9-0x0000000007480000-0x0000000007516000-memory.dmp

Filesize
600KB

Download
memory/2772-6-0x0000000005D80000-0x0000000005D8A000-memory.dmp

Filesize
40KB

Download
memory/2772-5-0x00000000059F0000-0x0000000005A00000-memory.dmp

Filesize
64KB

Download
memory/2772-0-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2772-3-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/2772-15-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2772-10-0x0000000009B30000-0x0000000009BCC000-memory.dmp

Filesize
624KB

Download
memory/2772-2-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/2772-1-0x0000000000CA0000-0x0000000000D64000-memory.dmp

Filesize
784KB

Download