Analysis
- max time kernel
179s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/03/2024, 12:54
General
- Target RoundedTB_canary20231016_2/RoundedTB/RoundedTB.exe
- Size 183.4MB
- Sample240306-p476qscc94
- SHA256 e8d67e60369a57c85cca5d7628144445e2badd9943f32c79bc0e433fba1405df
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoundedTB_canary20231016_2\RoundedTB\RoundedTB.exe"C:\Users\Admin\AppData\Local\Temp\RoundedTB_canary20231016_2\RoundedTB\RoundedTB.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/184-0-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/184-3-0x0000027ADAF90000-0x0000027ADBF18000-memory.dmp
memory/184-8-0x00007FF7D4DD0000-0x00007FF7D5717000-memory.dmp
memory/184-6-0x0000027ADA000000-0x0000027ADA228000-memory.dmp
memory/184-10-0x0000027AD8E50000-0x0000027AD8FAE000-memory.dmp
memory/184-13-0x0000027AD8D50000-0x0000027AD8D94000-memory.dmp
memory/184-16-0x0000027AD8DA0000-0x0000027AD8DDE000-memory.dmp
memory/184-19-0x0000027ADBF20000-0x0000027ADC762000-memory.dmp
memory/184-22-0x0000027ADA2C0000-0x0000027ADA340000-memory.dmp
memory/184-25-0x0000027AD8D30000-0x0000027AD8D3D000-memory.dmp
memory/184-28-0x0000027AD8D20000-0x0000027AD8D25000-memory.dmp
memory/184-31-0x0000027AD8E00000-0x0000027AD8E13000-memory.dmp
memory/184-34-0x0000027AD8D40000-0x0000027AD8D47000-memory.dmp
memory/184-37-0x0000027AD8E20000-0x0000027AD8E39000-memory.dmp
memory/184-40-0x0000027AD8FB0000-0x0000027AD8FC6000-memory.dmp
memory/184-43-0x0000027ADA280000-0x0000027ADA2C0000-memory.dmp
memory/184-46-0x0000027AD8DE0000-0x0000027AD8DF8000-memory.dmp
memory/184-49-0x0000027ADA230000-0x0000027ADA242000-memory.dmp
memory/184-52-0x0000027ADA700000-0x0000027ADA7F4000-memory.dmp
memory/184-55-0x0000027AD8FF0000-0x0000027AD8FF8000-memory.dmp
memory/184-58-0x0000027ADA390000-0x0000027ADA3D7000-memory.dmp
memory/184-61-0x0000027ADA250000-0x0000027ADA27A000-memory.dmp
memory/184-64-0x0000027ADE9B0000-0x0000027ADF1CC000-memory.dmp
memory/184-157-0x00007FF7D4DD0000-0x00007FF7D5717000-memory.dmp