Analysis
- max time kernel
92s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/01/2024, 16:16
General
- Target b8c7916053243e17a10baf53900aa9e8.exe
- Size 4.2MB
- Sample240115-tqsakscac7
- SHA256 831f2e5ec47feed2e11df2eaf1675462dba15c4aaab428ec9eae8b1591fd3fd7
Malware Config
Signatures
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c7916053243e17a10baf53900aa9e8.exe"C:\Users\Admin\AppData\Local\Temp\b8c7916053243e17a10baf53900aa9e8.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/3016-13-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-15-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/3016-3-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3016-4-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-5-0x0000000005F30000-0x00000000060F0000-memory.dmp
memory/3016-6-0x0000000007320000-0x00000000074B2000-memory.dmp
memory/3016-14-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-1-0x0000000000DB0000-0x00000000011E4000-memory.dmp
memory/3016-2-0x0000000005B90000-0x0000000005C2C000-memory.dmp
memory/3016-12-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-0-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3016-18-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-17-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-53-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3016-21-0x0000000007770000-0x0000000007870000-memory.dmp
memory/3016-16-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3016-19-0x0000000007770000-0x0000000007870000-memory.dmp
memory/3016-20-0x0000000007770000-0x0000000007870000-memory.dmp
memory/4124-39-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-25-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-36-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-35-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-33-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-30-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-29-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-28-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-27-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-26-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-24-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4124-41-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-42-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-44-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-31-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-46-0x0000000005A60000-0x0000000005AF2000-memory.dmp
memory/4124-45-0x0000000005F30000-0x00000000064D4000-memory.dmp
memory/4124-47-0x00000000058C0000-0x00000000058CA000-memory.dmp
memory/4124-22-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4124-54-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4124-55-0x0000000005070000-0x0000000005080000-memory.dmp