Analysis
- max time kernel
121s - max time network
126s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
06/03/2024, 12:54
General
- Target RoundedTB_canary20231016_2/RoundedTB/RoundedTB.exe
- Size 183.4MB
- Sample240306-p476qscc94
- SHA256 e8d67e60369a57c85cca5d7628144445e2badd9943f32c79bc0e433fba1405df
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoundedTB_canary20231016_2\RoundedTB\RoundedTB.exe"C:\Users\Admin\AppData\Local\Temp\RoundedTB_canary20231016_2\RoundedTB\RoundedTB.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3020 -s 8882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3020-0-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/3020-3-0x0000000004560000-0x00000000054E8000-memory.dmp
memory/3020-4-0x000000013F160000-0x000000013FAA7000-memory.dmp
memory/3020-7-0x0000000003810000-0x0000000003A38000-memory.dmp
memory/3020-10-0x00000000035D0000-0x000000000372E000-memory.dmp
memory/3020-13-0x0000000001C60000-0x0000000001CA4000-memory.dmp
memory/3020-16-0x0000000001E40000-0x0000000001E7E000-memory.dmp
memory/3020-19-0x00000000054F0000-0x0000000005D32000-memory.dmp
memory/3020-22-0x0000000002BE0000-0x0000000002C60000-memory.dmp
memory/3020-25-0x0000000000300000-0x000000000030D000-memory.dmp
memory/3020-28-0x00000000002F0000-0x00000000002F5000-memory.dmp
memory/3020-31-0x0000000001F00000-0x0000000001F13000-memory.dmp
memory/3020-34-0x0000000000330000-0x0000000000337000-memory.dmp
memory/3020-37-0x0000000001F20000-0x0000000001F39000-memory.dmp
memory/3020-40-0x0000000001F40000-0x0000000001F56000-memory.dmp
memory/3020-43-0x0000000001F60000-0x0000000001FA0000-memory.dmp
memory/3020-46-0x0000000000310000-0x0000000000328000-memory.dmp
memory/3020-49-0x0000000002040000-0x0000000002052000-memory.dmp
memory/3020-52-0x0000000003D40000-0x0000000003E34000-memory.dmp
memory/3020-55-0x0000000002060000-0x0000000002068000-memory.dmp
memory/3020-58-0x0000000003780000-0x00000000037C7000-memory.dmp
memory/3020-61-0x0000000003730000-0x000000000375A000-memory.dmp
memory/3020-64-0x0000000006570000-0x0000000006D8C000-memory.dmp
memory/3020-121-0x000000013F160000-0x000000013FAA7000-memory.dmp