Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
23/01/2024, 10:20
General
- Target file.exe
- Size 2.3MB
- Sample240123-mc32laabd8
- SHA256 ffb5ef0b8cc487e4993d3f1be4e9ed03b6e2ecabe89e8658bc0154c9d9f2d7d7
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/1852-11-0x00000000003D0000-0x00000000003E0000-memory.dmp
memory/1852-14-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-3-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-4-0x00000000052B0000-0x0000000005442000-memory.dmp
memory/1852-0-0x0000000000CE0000-0x0000000000F32000-memory.dmp
memory/1852-9-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-2-0x0000000074870000-0x0000000074F5E000-memory.dmp
memory/1852-13-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-10-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-12-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-1-0x0000000074870000-0x0000000074F5E000-memory.dmp
memory/1852-15-0x0000000005840000-0x0000000005940000-memory.dmp
memory/1852-16-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-17-0x0000000005490000-0x00000000054D0000-memory.dmp
memory/1852-50-0x0000000074870000-0x0000000074F5E000-memory.dmp
memory/2656-21-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-38-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-20-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-24-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-18-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-26-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-28-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-32-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-33-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-41-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-40-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2656-36-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-35-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-44-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-49-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-47-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-46-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-34-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-31-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-30-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2656-19-0x0000000000400000-0x000000000040E000-memory.dmp