Analysis

  • max time kernel
    1512s
  • max time network
    1471s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 12:04

General

  • Target

    Installer [GitHub]/x64/tradingnetworkingsockets.dll

  • Size

    4.1MB

  • MD5

    3cf26ce759c5e261fe3ecc6451b8b08e

  • SHA1

    b5da110034fe394a4020367404534903764473fe

  • SHA256

    fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1

  • SHA512

    e7b543483f38bb6338490b5c8f5da6f95e0d78b45f2b26d898cc3b58cf7c359952bfe413414cb6cd1532c3c6fd7a860026b2bec7b6d0ddfbee9a1385a62e14f2

  • SSDEEP

    49152:kGtlqhcIU6ilVwASObX9F+LWDumqrJjAZVT4kmrqEUAYVxkG3q+XRQsmqkALD4z4:M+dl7+8z1mqkA8lv0bH1bBGZZs

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\tradingnetworkingsockets.dll",#1
    1⤵
      PID:4300
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4384
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4588

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4588-0-0x000002A5FFE20000-0x000002A5FFE30000-memory.dmp

        Filesize

        64KB

      • memory/4588-16-0x000002A580340000-0x000002A580350000-memory.dmp

        Filesize

        64KB

      • memory/4588-32-0x000002A5886B0000-0x000002A5886B1000-memory.dmp

        Filesize

        4KB

      • memory/4588-34-0x000002A5886E0000-0x000002A5886E1000-memory.dmp

        Filesize

        4KB

      • memory/4588-35-0x000002A5886E0000-0x000002A5886E1000-memory.dmp

        Filesize

        4KB

      • memory/4588-36-0x000002A5887F0000-0x000002A5887F1000-memory.dmp

        Filesize

        4KB