Analysis
- max time kernel
134s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
21/02/2024, 16:03
General
- Target d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec.ps1
- Size 141KB
- Sample240221-thnx7aaf2x
- SHA256 d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec
Malware Config
Extracted
-
diceloader
-
5.8.63.218
-
193.233.22.171
Signatures
- DiceLoader
DiceLoader is a loader written in C++.
- Blocklisted process makes network request 11 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d14f9ea22c90e32238a5cd69d772cd8b60fbf911139ce0bdccd07b17ab4bb5ec.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b44w5im4.iyc.ps1
memory/3080-8-0x000001AF2A730000-0x000001AF2A752000-memory.dmp
memory/3080-9-0x00007FFCFB590000-0x00007FFCFC052000-memory.dmp
memory/3080-10-0x000001AF2A6B0000-0x000001AF2A6C0000-memory.dmp
memory/3080-11-0x000001AF2A6B0000-0x000001AF2A6C0000-memory.dmp
memory/3080-12-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp
memory/3080-13-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp
memory/3080-15-0x000001AF12240000-0x000001AF12246000-memory.dmp
memory/3080-14-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp
memory/3080-16-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp
memory/3080-17-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp
memory/3080-18-0x00007FFCFB590000-0x00007FFCFC052000-memory.dmp
memory/3080-19-0x000001AF2A6B0000-0x000001AF2A6C0000-memory.dmp
memory/3080-20-0x000001AF2A6B0000-0x000001AF2A6C0000-memory.dmp
memory/3080-21-0x000001AF2A6A0000-0x000001AF2A6A6000-memory.dmp