4d6bcae5eb557b4f84e9b19fb679a4c109290d811c68018815ab6c48d4228346

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

796KB
MD5

5deb964f3b14a5af71991745fb8d1724
SHA1

7d72eb66ea84887760cd19b8f40bfbd01c2a5ae0
SHA256

4d6bcae5eb557b4f84e9b19fb679a4c109290d811c68018815ab6c48d4228346
SHA512

697eed7521e189a05befcbe85df86f0175fd6ae8a2b7fc5b3741ff993ddf455068a6b4315737ffdea0c4df4d2e0f1cefe3a86de5334604cee5c5ba6331e18d73
SSDEEP

12288:oqLTgFrogGDk3a+kjWt6yIjixZbnrzJXUTvxN/u7yS9QHvc/YRsa8Uu:B4QBr6nFNnrz6TvD9UwR4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 284	2492	Launcher.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	Launcher.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28
PID 2492 wrote to memory of 284	2492	Launcher.exe	28

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-15-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-11-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-19-0x0000000000401000-0x000000000045E000-memory.dmp

Filesize
372KB

Download
memory/284-18-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/284-12-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-6-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-8-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/284-10-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2492-5-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2492-1-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2492-4-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2492-0-0x00000000009B0000-0x0000000000A7E000-memory.dmp

Filesize
824KB

Download
memory/2492-16-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2492-3-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2492-20-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2492-2-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads