Analysis

  • max time kernel
    1684s
  • max time network
    1709s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 12:04

General

  • Target

    Installer [GitHub]/x64/3.dll

  • Size

    3.8MB

  • MD5

    7a928c77b433462246a9fba8fe0f2cc8

  • SHA1

    7b424a55a6276a8c0112cb94bb4c1bf0f45ca8d1

  • SHA256

    4bafdd9d0587bdc8bac5c5c510f863592a80b80a39bc4f5e5d1741f0b3fe9505

  • SHA512

    47bae60ca35527ad749f4f5444cb1c3d3bbc9e6ba4c4e62f0c5c45c32d461d43fd0989869d99c1d310ca09463fe2ca91eb31f59746930f1dd0deb96678265ec7

  • SSDEEP

    6144:n8K3IMDr6S9RsSXEcA5X96K7Rdh65YmFZ7C4:N3IMnF9749h7rh65YmX

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\3.dll",#1
    1⤵
      PID:3816
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:2972
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4864

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

        Filesize

        16KB

        MD5

        25074a416be4a6cdc39b077c1de24e49

        SHA1

        b8b16097fa5477a083c5406299a6e9662e490e77

        SHA256

        efcef519f9f4d62e24bcfdd55311dd1be70a65b873c7268265b7e32dbd4dc2a2

        SHA512

        182f24fc047af0b2f023ddae2624513033dd916168e1fe3a5fa53747171a75c4e05fdfe239e9e8f57e0dfa32150dd385691dc69826d937490d6cf3e0b36ced4d

      • memory/4864-40-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-33-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-42-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-34-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-35-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-36-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-37-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-38-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-43-0x000001F934230000-0x000001F934231000-memory.dmp

        Filesize

        4KB

      • memory/4864-0-0x000001F92BF40000-0x000001F92BF50000-memory.dmp

        Filesize

        64KB

      • memory/4864-68-0x000001F934480000-0x000001F934481000-memory.dmp

        Filesize

        4KB

      • memory/4864-32-0x000001F9345E0000-0x000001F9345E1000-memory.dmp

        Filesize

        4KB

      • memory/4864-39-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB

      • memory/4864-44-0x000001F934220000-0x000001F934221000-memory.dmp

        Filesize

        4KB

      • memory/4864-46-0x000001F934230000-0x000001F934231000-memory.dmp

        Filesize

        4KB

      • memory/4864-49-0x000001F934220000-0x000001F934221000-memory.dmp

        Filesize

        4KB

      • memory/4864-52-0x000001F934160000-0x000001F934161000-memory.dmp

        Filesize

        4KB

      • memory/4864-16-0x000001F92C040000-0x000001F92C050000-memory.dmp

        Filesize

        64KB

      • memory/4864-64-0x000001F934360000-0x000001F934361000-memory.dmp

        Filesize

        4KB

      • memory/4864-66-0x000001F934370000-0x000001F934371000-memory.dmp

        Filesize

        4KB

      • memory/4864-67-0x000001F934370000-0x000001F934371000-memory.dmp

        Filesize

        4KB

      • memory/4864-41-0x000001F934610000-0x000001F934611000-memory.dmp

        Filesize

        4KB