Analysis
-
max time kernel
129s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
05/03/2024, 15:05
General
-
Target
Vulkan/Assets/Bootstrapper.exe
-
Size
198KB
-
MD5
3a61d18866ec289415e213ab5d34de69
-
SHA1
83c29a47600dc00feb87954418e3873edd42e4aa
-
SHA256
e5807f713d9b89a54c8916d30705401e82c83b74a3b195db5b399e90ff945ce1
-
SHA512
a88d52d94acf8ee8858bad9dadebadd7c0d09572f459f28d01fef35c9dd1b5af51a96a2b13b4b5fbea8e483c2832d3a6d4a0cc9b60ebbe343a8c65c0de8d2ed4
-
SSDEEP
1536:96R6ONuvr2zhBIEMUkwV/n1EnXONHLfE6XZ3bU9dbJOOI:buh/fP1EXyzsOT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vulkan\Assets\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Vulkan\Assets\Bootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vulkan\Assets\Application\vulkan.exe"C:\Users\Admin\AppData\Local\Temp\Vulkan\Assets\Application\vulkan.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD59b5b0038451fe15de9b7caca8938cf8e
SHA1ddf094b90dbe5e1bf407d99b50c9362a46bc3f36
SHA25663febda7441e0f49c07e504f462bd48f261bf4f16b7772dde41ddeb7b02ca9d8
SHA512b42e43db823add4f057debf71ffb928fa8f06dea42ec8acda5281993502591d126aad711cd10f88a074850389ce0fef204a08e7c5d05f68951a612657f956902
-
Filesize
216KB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
6.9MB