Analysis
- max time kernel
140s - max time network
138s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/04/2024, 05:56
General
- Target update.exe
- Size 3.2MB
- Sample240407-gm2cvsfa32
- SHA256 014c71aaf8d2bad59079b20cfa748cc4ee25fef57d3aafd4864410fb05b2c23f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\SystemBak\update.exeC:\SystemBak\update.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
update.exe
memory/2144-0-0x0000000140000000-0x0000000140337000-memory.dmp
memory/2144-4-0x0000000140000000-0x0000000140337000-memory.dmp
memory/2488-3-0x0000000140000000-0x0000000140337000-memory.dmp
memory/2488-5-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-6-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-7-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-8-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-12-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-13-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-11-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-10-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-9-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-14-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-15-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-16-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-17-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-18-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-19-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-20-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-21-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-22-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-23-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-24-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-25-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-26-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-27-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-28-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-29-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-30-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-31-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-32-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-33-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-34-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-35-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-36-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-37-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-38-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-39-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-41-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-40-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-42-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-43-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-44-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-45-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-46-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-47-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-48-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-51-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-52-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-50-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-49-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-53-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-54-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-55-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-56-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-57-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-58-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-59-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-60-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-61-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-62-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-63-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-64-0x0000000002740000-0x00000000027C7000-memory.dmp
memory/2488-65-0x0000000002740000-0x00000000027C7000-memory.dmp