Overview
overview
7Static
static
7675d673a9d...e4.exe
windows7-x64
3675d673a9d...e4.exe
windows10-2004-x64
3$EXEFILE.exe
windows7-x64
4$EXEFILE.exe
windows10-2004-x64
4$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3wget.exe
windows7-x64
7wget.exe
windows10-2004-x64
7Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 10:18
Behavioral task
behavioral1
Sample
675d673a9d78e63f490126ac88a8a3e4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
675d673a9d78e63f490126ac88a8a3e4.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$EXEFILE.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$EXEFILE.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
wget.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
wget.exe
Resource
win10v2004-20231222-en
General
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
0116a50101c4107a138a588d1e46fca5
-
SHA1
b781dce23e828cf2b97306661c7dad250a6aaf77
-
SHA256
ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
-
SHA512
55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 5076 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4156 wrote to memory of 4684 4156 rundll32.exe rundll32.exe PID 4156 wrote to memory of 4684 4156 rundll32.exe rundll32.exe PID 4156 wrote to memory of 4684 4156 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#12⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5076-16-0x00000219F0240000-0x00000219F0250000-memory.dmpFilesize
64KB
-
memory/5076-0-0x00000219F0140000-0x00000219F0150000-memory.dmpFilesize
64KB
-
memory/5076-34-0x00000219F85C0000-0x00000219F85C1000-memory.dmpFilesize
4KB
-
memory/5076-32-0x00000219F8590000-0x00000219F8591000-memory.dmpFilesize
4KB
-
memory/5076-35-0x00000219F85C0000-0x00000219F85C1000-memory.dmpFilesize
4KB
-
memory/5076-36-0x00000219F86D0000-0x00000219F86D1000-memory.dmpFilesize
4KB