Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/02/2024, 06:37
General
- Target adec4c33278e84ae4cea0d1ea0aec2e9.exe
- Size 162KB
- Sample240229-hdlrgshd26
- SHA256 48aba6349833b59d89f519ffd5bf72c1d6b988477b1b7737275e21059c5f71fc
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Loads dropped DLL 4 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Modifies registry class 6 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adec4c33278e84ae4cea0d1ea0aec2e9.exe"C:\Users\Admin\AppData\Local\Temp\adec4c33278e84ae4cea0d1ea0aec2e9.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
comrep.dll
cryptdl.dll
memory/2748-16-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2748-17-0x0000000002230000-0x0000000002267000-memory.dmp
memory/2748-10-0x0000000002230000-0x0000000002267000-memory.dmp
memory/2748-11-0x0000000002230000-0x0000000002267000-memory.dmp
memory/2748-12-0x0000000000530000-0x000000000055F000-memory.dmp
memory/2748-13-0x00000000021F0000-0x000000000222A000-memory.dmp
memory/2748-0-0x0000000000530000-0x000000000055F000-memory.dmp
memory/2748-7-0x00000000021F0000-0x000000000222A000-memory.dmp
memory/2748-1-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2748-33-0x00000000001C0000-0x00000000001D5000-memory.dmp
memory/2748-34-0x00000000001C0000-0x00000000001D5000-memory.dmp
memory/2748-35-0x00000000001E0000-0x00000000001F2000-memory.dmp
memory/2748-42-0x00000000001C0000-0x00000000001D5000-memory.dmp
memory/2748-46-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2748-47-0x0000000002230000-0x0000000002267000-memory.dmp
memory/2748-48-0x00000000001E0000-0x00000000001F2000-memory.dmp