af86006262e394a832aa6d8ee25aa34215fbedda54ccac04da3b5406c772c5cd | Triage

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 14:37

Sharing

Report Analysis Logs

General

Target

devldr
Size

1KB
MD5

bca1b0fa2b2cb4a8d150194dd1608a5b
SHA1

4ce56eb160bf869af4844ab3c4768446e0c2ff11
SHA256

1d387fd7477bb59c22f5e9b55351fb506a44adaf4f6f1b5711c8f4d0682a177e
SHA512

d1044c0c71ec47081c7c0ef80369d702e22e763593f9f775b040cd5a572a029accc429fe08be798d9395fe4316f0882ef38855e40e1ddf04e4c47dffcbfab722

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe
2984	devldr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	devldr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2984	4640	cmd.exe	89
PID 4640 wrote to memory of 2984	4640	cmd.exe	89
PID 4640 wrote to memory of 2984	4640	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\devldr
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\devldr.exe
  C:\Users\Admin\AppData\Local\Temp\devldr
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads