Analysis
- max time kernel
151s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 00:26
General
- Target $_2_/DownloadManager.exe
- Size 1.3MB
- Sample240125-arnh8scdgp
- SHA256 33ab2810cab812621f8e8bf1d30e49a41570af00693db2bfabff69c6d242bd01
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_2_\DownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\$_2_\DownloadManager.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3396-0-0x00007FF8BCC40000-0x00007FF8BD5E1000-memory.dmp
memory/3396-1-0x00007FF8BCC40000-0x00007FF8BD5E1000-memory.dmp
memory/3396-4-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-11-0x000000001C020000-0x000000001C068000-memory.dmp
memory/3396-14-0x000000001D1D0000-0x000000001D69E000-memory.dmp
memory/3396-15-0x000000001D6A0000-0x000000001D73C000-memory.dmp
memory/3396-16-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-17-0x000000001BC10000-0x000000001BC18000-memory.dmp
memory/3396-18-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-19-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-20-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-21-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-23-0x0000000021420000-0x0000000021BC6000-memory.dmp
memory/3396-24-0x00007FF8BCC40000-0x00007FF8BD5E1000-memory.dmp
memory/3396-25-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-26-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-27-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-28-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-29-0x0000000001600000-0x0000000001610000-memory.dmp
memory/3396-30-0x0000000001600000-0x0000000001610000-memory.dmp