Analysis
- max time kernel
145s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/03/2024, 01:18
General
- Target ea3fbfa72d7732f9b1e5c1a66ac65a72a0a02cf3cd9f33d3818ee4a659c49d3e.exe
- Size 162.0MB
- Sample240308-bn9sqsbc68
- SHA256 ea3fbfa72d7732f9b1e5c1a66ac65a72a0a02cf3cd9f33d3818ee4a659c49d3e
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3fbfa72d7732f9b1e5c1a66ac65a72a0a02cf3cd9f33d3818ee4a659c49d3e.exe"C:\Users\Admin\AppData\Local\Temp\ea3fbfa72d7732f9b1e5c1a66ac65a72a0a02cf3cd9f33d3818ee4a659c49d3e.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3048-3-0x000001F20BCB0000-0x000001F20BCC0000-memory.dmp
memory/3048-19-0x000001F20BDB0000-0x000001F20BDC0000-memory.dmp
memory/3048-35-0x000001F2143A0000-0x000001F2143A1000-memory.dmp
memory/3048-36-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-37-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-38-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-39-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-40-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-41-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-42-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-43-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-44-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-45-0x000001F2143D0000-0x000001F2143D1000-memory.dmp
memory/3048-46-0x000001F213FF0000-0x000001F213FF1000-memory.dmp
memory/3048-47-0x000001F213FE0000-0x000001F213FE1000-memory.dmp
memory/3048-49-0x000001F213FF0000-0x000001F213FF1000-memory.dmp
memory/3048-52-0x000001F213FE0000-0x000001F213FE1000-memory.dmp
memory/3048-55-0x000001F213F20000-0x000001F213F21000-memory.dmp
memory/3048-67-0x000001F214120000-0x000001F214121000-memory.dmp
memory/3048-69-0x000001F214130000-0x000001F214131000-memory.dmp
memory/3048-70-0x000001F214130000-0x000001F214131000-memory.dmp
memory/3048-71-0x000001F214240000-0x000001F214241000-memory.dmp