Analysis
- max time kernel
0s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 03:51
General
- Target 百度营销王9.0/E路采集王.exe
- Size 172KB
- Sample240108-eespmsbfd3
- SHA256 54f75b7e43147f4743f0872834068239e9a9162725a27abe2b7f27a91f7331c2
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\百度营销王9.0\E路采集王.exe"C:\Users\Admin\AppData\Local\Temp\百度营销王9.0\E路采集王.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8122⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4872-1-0x0000000001440000-0x0000000001450000-memory.dmp
memory/4872-2-0x00007FFBADA40000-0x00007FFBAE3E1000-memory.dmp
memory/4872-9-0x00007FFBADA40000-0x00007FFBAE3E1000-memory.dmp
memory/4872-0-0x00007FFBADA40000-0x00007FFBAE3E1000-memory.dmp