Resubmissions
09/04/2024, 10:11
240409-l75m8scd58909/04/2024, 10:09
240409-l6vfwacd37909/04/2024, 10:09
240409-l6t54scd36909/04/2024, 10:09
240409-l6tjksff51913/03/2024, 02:34
240313-c2ncbsce2910Analysis
- max time kernel
591s - max time network
604s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
09/04/2024, 10:09
General
- Target 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
- Size 39KB
- Sample240409-l6t54scd36
- SHA256 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6
Score
9/10
Malware Config
Signatures
- Contacts a large (4217) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe"C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4256-0-0x000001CFA1EA0000-0x000001CFA1EAE000-memory.dmp
memory/4256-1-0x00007FF95D0D0000-0x00007FF95DABC000-memory.dmp
memory/4256-2-0x000001CFBC500000-0x000001CFBC510000-memory.dmp
memory/4256-3-0x00007FF95D0D0000-0x00007FF95DABC000-memory.dmp
memory/4256-4-0x000001CFBC500000-0x000001CFBC510000-memory.dmp