Resubmissions
24-01-2024 08:44
240124-kne3ssecfm 1024-01-2024 08:20
240124-j8dvssdgen 1023-01-2024 11:38
240123-nryabshhbk 1005-02-2022 13:33
220205-qtgrgabgg4 10Analysis
-
max time kernel
1136s -
max time network
1142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 08:20
Behavioral task
behavioral1
Sample
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe
Resource
win10v2004-20231215-en
General
-
Target
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe
-
Size
184KB
-
MD5
c844efe1b7e76cbdea36ce62ff788de9
-
SHA1
d8143cf09bff7b0ca2a0c777912746a5922104ee
-
SHA256
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
-
SHA512
52b350965940c785c0a9f3991016ee14a303d49a4168bf5c008bbaafe301cd93e7201965ced9f1e8cdf5f31414c128fdc546461ff21af45c9ae17c3f462d4931
-
SSDEEP
3072:brenHphylBa5vbUVmpg+Rrf17JhNO429gs6F4FO7MvA+lVJeTf7ko2bCHkMwGAkI:UglEzu+pxJhNC9gsxFO7idlzaQo2bVlt
Malware Config
Extracted
zloader
TelegramCrypt
AntiAMSIdoc
http://wmwifbajxxbcxmucxmlc.com/post.php
http://pwkqhdgytsshkoibaake.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fyratyubvflktyyjiqgq.com/post.php
-
build_id
115
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exedescription pid process target process PID 3352 set thread context of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 3724 msiexec.exe Token: SeSecurityPrivilege 3724 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exedescription pid process target process PID 3352 wrote to memory of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe PID 3352 wrote to memory of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe PID 3352 wrote to memory of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe PID 3352 wrote to memory of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe PID 3352 wrote to memory of 3724 3352 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe"C:\Users\Admin\AppData\Local\Temp\835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3724-0-0x0000000000E20000-0x0000000000E54000-memory.dmpFilesize
208KB
-
memory/3724-1-0x0000000000E20000-0x0000000000E54000-memory.dmpFilesize
208KB
-
memory/3724-3-0x0000000000E20000-0x0000000000E54000-memory.dmpFilesize
208KB
-
memory/3724-4-0x0000000000E20000-0x0000000000E54000-memory.dmpFilesize
208KB