Analysis
- max time kernel
1775s - max time network
1738s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 17:02
General
- Target BotNets/WarBot/(HTTP Botnet) Warbot Botnet Tutorial.url
- Size 140B
- Sample240404-vkchlsdg73
- SHA256 930cf43badc59d3bf4afa9cdb66c00e1e8490407442747a16fa1db280ca87e64
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\BotNets\WarBot\(HTTP Botnet) Warbot Botnet Tutorial.url"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5032-0-0x000001E139040000-0x000001E139050000-memory.dmp
memory/5032-16-0x000001E139140000-0x000001E139150000-memory.dmp
memory/5032-32-0x000001E141450000-0x000001E141451000-memory.dmp
memory/5032-34-0x000001E141480000-0x000001E141481000-memory.dmp
memory/5032-35-0x000001E141480000-0x000001E141481000-memory.dmp
memory/5032-36-0x000001E141590000-0x000001E141591000-memory.dmp