Analysis
- max time kernel
144s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 01:04
General
- Target c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9.exe
- Size 7.8MB
- Sample240108-bfb7haaef9
- SHA256 c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9.exe"C:\Users\Admin\AppData\Local\Temp\c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9.exe"C:\Users\Admin\AppData\Local\Temp\c95f6ef5f0059d615bcadacf39e051d39d5e8e72d2dff726b687b541f0a947d9.exe"2⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/392-23-0x0000000000400000-0x0000000000A49000-memory.dmp
memory/392-25-0x0000000001650000-0x0000000001651000-memory.dmp
memory/392-36-0x0000000005180000-0x0000000005181000-memory.dmp
memory/392-34-0x0000000004190000-0x0000000004193000-memory.dmp
memory/392-9-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-33-0x0000000004030000-0x0000000004031000-memory.dmp
memory/392-12-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/392-15-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-19-0x0000000004020000-0x0000000004021000-memory.dmp
memory/392-17-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-18-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/392-20-0x0000000004190000-0x0000000004193000-memory.dmp
memory/392-16-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/392-21-0x0000000000400000-0x0000000000A49000-memory.dmp
memory/392-32-0x0000000004020000-0x0000000004021000-memory.dmp
memory/392-29-0x0000000000400000-0x0000000000A49000-memory.dmp
memory/392-27-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-10-0x0000000000400000-0x0000000000A49000-memory.dmp
memory/392-30-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-6-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-13-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-24-0x0000000005180000-0x0000000005181000-memory.dmp
memory/392-14-0x0000000000BD0000-0x0000000000E70000-memory.dmp
memory/392-28-0x00000000031E0000-0x00000000031E1000-memory.dmp
memory/2192-7-0x0000000010000000-0x0000000010791000-memory.dmp
memory/2192-0-0x0000000000400000-0x0000000000BC5000-memory.dmp
memory/2192-2-0x0000000010000000-0x0000000010791000-memory.dmp
memory/2192-11-0x0000000000400000-0x0000000000BC5000-memory.dmp
memory/2192-5-0x0000000010000000-0x0000000010791000-memory.dmp
memory/2192-1-0x0000000010000000-0x0000000010791000-memory.dmp