Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 12:18
General
- Target 9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439.exe
- Size 874KB
- Sample240408-pgldfscc2w
- SHA256 9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439.exe"C:\Users\Admin\AppData\Local\Temp\9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439.exe"C:\Users\Admin\AppData\Local\Temp\9d4ba0d30577e0398c95e01ff42e2ea2f2f02dcb50ff3202f6077de094e7a439.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4352 -ip 43521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4072-6-0x0000000008D40000-0x0000000008DDC000-memory.dmp
memory/4072-12-0x0000000074810000-0x0000000074FC0000-memory.dmp
memory/4072-2-0x0000000007A80000-0x0000000008024000-memory.dmp
memory/4072-3-0x0000000007570000-0x0000000007602000-memory.dmp
memory/4072-4-0x0000000007770000-0x0000000007780000-memory.dmp
memory/4072-5-0x0000000007520000-0x000000000752A000-memory.dmp
memory/4072-8-0x0000000002930000-0x000000000293C000-memory.dmp
memory/4072-0-0x0000000000570000-0x000000000064E000-memory.dmp
memory/4072-1-0x0000000074810000-0x0000000074FC0000-memory.dmp
memory/4072-9-0x0000000008830000-0x00000000088BA000-memory.dmp
memory/4072-7-0x0000000002910000-0x0000000002922000-memory.dmp
memory/4352-13-0x0000000001850000-0x0000000001B9A000-memory.dmp
memory/4352-10-0x0000000000400000-0x0000000000443000-memory.dmp
memory/4352-14-0x0000000000400000-0x0000000000443000-memory.dmp