Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
20/01/2024, 16:08
General
- Target bTcN.exe
- Size 32KB
- Sample240120-tk7s3sdaf9
- SHA256 59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bTcN.exe"C:\Users\Admin\AppData\Local\Temp\bTcN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-22-0x0000012292A40000-0x0000012292A50000-memory.dmp
memory/964-38-0x000001229AD30000-0x000001229AD31000-memory.dmp
memory/964-40-0x000001229AD60000-0x000001229AD61000-memory.dmp
memory/964-42-0x000001229AE70000-0x000001229AE71000-memory.dmp
memory/964-41-0x000001229AD60000-0x000001229AD61000-memory.dmp
memory/4936-0-0x0000000074D80000-0x0000000075331000-memory.dmp
memory/4936-1-0x0000000074D80000-0x0000000075331000-memory.dmp
memory/4936-2-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/4936-3-0x0000000074D80000-0x0000000075331000-memory.dmp
memory/4936-4-0x0000000074D80000-0x0000000075331000-memory.dmp
memory/4936-5-0x00000000013D0000-0x00000000013E0000-memory.dmp