Analysis
- max time kernel
135s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
21/02/2024, 16:03
General
- Target d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec.ps1
- Size 141KB
- Sample240221-thnx7aaf2x
- SHA256 d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec
Malware Config
Extracted
-
diceloader
-
5.8.63.218
-
193.233.22.171
Signatures
- DiceLoader
DiceLoader is a loader written in C++.
- Blocklisted process makes network request 11 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_o4fapgep.vbp.ps1
memory/3468-9-0x00000299D3EB0000-0x00000299D3ED2000-memory.dmp
memory/3468-10-0x00007FFC00830000-0x00007FFC012F1000-memory.dmp
memory/3468-11-0x00000299D1D30000-0x00000299D1D40000-memory.dmp
memory/3468-12-0x00000299D1D30000-0x00000299D1D40000-memory.dmp
memory/3468-13-0x00000299D1D30000-0x00000299D1D40000-memory.dmp
memory/3468-16-0x00000299B97E0000-0x00000299B97E6000-memory.dmp
memory/3468-15-0x00000299D1D00000-0x00000299D1D06000-memory.dmp
memory/3468-14-0x00000299D1D00000-0x00000299D1D06000-memory.dmp
memory/3468-18-0x00000299D1D00000-0x00000299D1D06000-memory.dmp
memory/3468-19-0x00000299D1D00000-0x00000299D1D06000-memory.dmp
memory/3468-20-0x00000299D1D00000-0x00000299D1D06000-memory.dmp
memory/3468-21-0x00007FFC00830000-0x00007FFC012F1000-memory.dmp
memory/3468-22-0x00000299D1D30000-0x00000299D1D40000-memory.dmp
memory/3468-23-0x00000299D1D30000-0x00000299D1D40000-memory.dmp
memory/3468-24-0x00000299D1D00000-0x00000299D1D06000-memory.dmp