Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 18:48

General

  • Target

    a9e5dd8100bd155709a1bcd4514fdbbf.exe

  • Size

    23KB

  • MD5

    a9e5dd8100bd155709a1bcd4514fdbbf

  • SHA1

    44a2a089ef14d430c1e1fef26947031e7be05405

  • SHA256

    3a43645316098abeb00921f8ec18a1dacd9f61f291cd74574bd8aed58f6080dd

  • SHA512

    d2b9d2eadb52746564f8285041910b09a943dda7e00fd2105f77facebca395aca8f6c555ae0296dabcdf7ec6655d090fe922c9c1cb7ccfaebccca55dd1192c64

  • SSDEEP

    384:B1XBRhrRzo86Zv0Yp57thkUpsSqBX8z6wswlFZUgkDM693dgoI/OzMGoaWyO2id5:BpzrgzjxhFpq8z690wnk2zMyWyO2o

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9e5dd8100bd155709a1bcd4514fdbbf.exe
    "C:\Users\Admin\AppData\Local\Temp\a9e5dd8100bd155709a1bcd4514fdbbf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3964

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\a9e5dd8100bd155709a1bcd4514fdbbfxz.dll

          Filesize

          42KB

          MD5

          b08ae5d4c41a912a367c274e49eb65af

          SHA1

          d6035a2efbedc6d428d99e36ac901d4b226e3ee0

          SHA256

          4cb7887dd47897099f504756ef4c8f458069a18ffd0993da30d2c0b6ba368227

          SHA512

          2fdb43b0f9cd87426c9c66231826f63665b3f2867e096556b1c34aa0a58f4c554a3d9a8c3a95617b63cadf0f6a204ca5b5d4b65c558d8ea9284b228661a8c78e

        • memory/3964-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/3964-7-0x00000000005F0000-0x0000000000600000-memory.dmp

          Filesize

          64KB

        • memory/3964-10-0x00000000005F0000-0x0000000000600000-memory.dmp

          Filesize

          64KB

        • memory/3964-12-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/3964-13-0x00000000005F0000-0x0000000000600000-memory.dmp

          Filesize

          64KB

        • memory/3964-24-0x00000000005F0000-0x0000000000600000-memory.dmp

          Filesize

          64KB