Analysis
- max time kernel
148s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
08/03/2024, 06:32
General
- Target Overdue Account Notice.exe
- Size 658KB
- Sample240308-halmbahe53
- SHA256 b8d16e3baf21ebb5ac7c138bcf5a71c4b195d41dd96d58919052bb3567bd367d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Account Notice.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Account Notice.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Overdue Account Notice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nqcjplx3.mu0.ps1
memory/3036-47-0x0000000006C60000-0x0000000006D03000-memory.dmp
memory/3036-16-0x0000000004DB0000-0x00000000053D8000-memory.dmp
memory/3036-59-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/3036-56-0x00000000070D0000-0x00000000070D8000-memory.dmp
memory/3036-55-0x00000000070F0000-0x000000000710A000-memory.dmp
memory/3036-54-0x0000000006FF0000-0x0000000007004000-memory.dmp
memory/3036-53-0x0000000006FE0000-0x0000000006FEE000-memory.dmp
memory/3036-52-0x0000000006FB0000-0x0000000006FC1000-memory.dmp
memory/3036-51-0x0000000007030000-0x00000000070C6000-memory.dmp
memory/3036-50-0x0000000006E20000-0x0000000006E2A000-memory.dmp
memory/3036-11-0x0000000000D00000-0x0000000000D36000-memory.dmp
memory/3036-48-0x00000000073F0000-0x0000000007A6A000-memory.dmp
memory/3036-13-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/3036-14-0x0000000002390000-0x00000000023A0000-memory.dmp
memory/3036-49-0x0000000006DB0000-0x0000000006DCA000-memory.dmp
memory/3036-45-0x0000000002390000-0x00000000023A0000-memory.dmp
memory/3036-15-0x0000000002390000-0x00000000023A0000-memory.dmp
memory/3036-18-0x0000000004BD0000-0x0000000004BF2000-memory.dmp
memory/3036-46-0x0000000006030000-0x000000000604E000-memory.dmp
memory/3036-19-0x0000000004C70000-0x0000000004CD6000-memory.dmp
memory/3036-34-0x0000000006050000-0x0000000006082000-memory.dmp
memory/3036-30-0x0000000005650000-0x00000000059A4000-memory.dmp
memory/3036-31-0x0000000005A80000-0x0000000005A9E000-memory.dmp
memory/3036-32-0x0000000005AC0000-0x0000000005B0C000-memory.dmp
memory/3036-33-0x000000007F830000-0x000000007F840000-memory.dmp
memory/3036-22-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/3036-35-0x000000006EF80000-0x000000006EFCC000-memory.dmp
memory/3724-5-0x0000000005250000-0x000000000525A000-memory.dmp
memory/3724-17-0x0000000005200000-0x0000000005210000-memory.dmp
memory/3724-0-0x00000000007E0000-0x0000000000886000-memory.dmp
memory/3724-1-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/3724-12-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/3724-8-0x0000000005850000-0x000000000585E000-memory.dmp
memory/3724-10-0x0000000008FD0000-0x000000000906C000-memory.dmp
memory/3724-2-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/3724-7-0x0000000005840000-0x000000000584A000-memory.dmp
memory/3724-6-0x0000000005510000-0x0000000005524000-memory.dmp
memory/3724-4-0x0000000005200000-0x0000000005210000-memory.dmp
memory/3724-9-0x0000000006970000-0x00000000069F2000-memory.dmp
memory/3724-3-0x00000000052F0000-0x0000000005382000-memory.dmp