Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 10:04
Static task
static1
Behavioral task
behavioral1
Sample
be53972da967ed278f4f4685725e3695.exe
Resource
win7-20240221-en
General
-
Target
be53972da967ed278f4f4685725e3695.exe
-
Size
364KB
-
MD5
be53972da967ed278f4f4685725e3695
-
SHA1
fe5116e4a0b8885611edb33f2bcdf2290701c0d2
-
SHA256
d633a81a25c74e26acf55254999bed3ce9cc88734f8d7697a4eb678e575ad117
-
SHA512
cbc8924d995fa8fe50d5b2fedb1aa3cbb6b16ee166721a97528cef153778dee736fa4086196438c1388f2f14df0fc90474f3fa95ec482d368d554d1c318a75b4
-
SSDEEP
6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANz:WBOO3VKID90TBEhx4O6az
Malware Config
Signatures
-
Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/4628-3-0x0000000000AA0000-0x0000000000AD2000-memory.dmp dave behavioral2/memory/4628-6-0x0000000000610000-0x0000000000640000-memory.dmp dave -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
be53972da967ed278f4f4685725e3695.exepid process 4628 be53972da967ed278f4f4685725e3695.exe 4628 be53972da967ed278f4f4685725e3695.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2988 wermgr.exe Token: SeDebugPrivilege 2988 wermgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
be53972da967ed278f4f4685725e3695.exedescription pid process target process PID 4628 wrote to memory of 2988 4628 be53972da967ed278f4f4685725e3695.exe wermgr.exe PID 4628 wrote to memory of 2988 4628 be53972da967ed278f4f4685725e3695.exe wermgr.exe PID 4628 wrote to memory of 2988 4628 be53972da967ed278f4f4685725e3695.exe wermgr.exe PID 4628 wrote to memory of 2988 4628 be53972da967ed278f4f4685725e3695.exe wermgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\be53972da967ed278f4f4685725e3695.exe"C:\Users\Admin\AppData\Local\Temp\be53972da967ed278f4f4685725e3695.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2988-167-0x00000128C83C0000-0x00000128C83E4000-memory.dmpFilesize
144KB
-
memory/2988-169-0x00000128C83C0000-0x00000128C83E4000-memory.dmpFilesize
144KB
-
memory/4628-3-0x0000000000AA0000-0x0000000000AD2000-memory.dmpFilesize
200KB
-
memory/4628-6-0x0000000000610000-0x0000000000640000-memory.dmpFilesize
192KB
-
memory/4628-10-0x0000000000B10000-0x0000000000B3F000-memory.dmpFilesize
188KB
-
memory/4628-9-0x0000000000AE0000-0x0000000000B0E000-memory.dmpFilesize
184KB
-
memory/4628-8-0x0000000000B10000-0x0000000000B3F000-memory.dmpFilesize
188KB
-
memory/4628-94-0x0000000000B10000-0x0000000000B3F000-memory.dmpFilesize
188KB
-
memory/4628-166-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/4628-165-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4628-168-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/4628-170-0x0000000000B10000-0x0000000000B3F000-memory.dmpFilesize
188KB