Resubmissions
09/04/2024, 10:11
240409-l75m8scd58909/04/2024, 10:09
240409-l6vfwacd37909/04/2024, 10:09
240409-l6t54scd36909/04/2024, 10:09
240409-l6tjksff51913/03/2024, 02:34
240313-c2ncbsce2910Analysis
- max time kernel
615s - max time network
877s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
09/04/2024, 10:09
General
- Target 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
- Size 39KB
- Sample240409-l6vfwacd37
- SHA256 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6
Score
9/10
Malware Config
Signatures
- Contacts a large (4218) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe"C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4196-0-0x0000015E62D00000-0x0000015E62D0E000-memory.dmp
memory/4196-1-0x00007FFCAD0E0000-0x00007FFCADACC000-memory.dmp
memory/4196-2-0x0000015E7D1E0000-0x0000015E7D1F0000-memory.dmp
memory/4196-3-0x00007FFCAD0E0000-0x00007FFCADACC000-memory.dmp
memory/4196-4-0x0000015E7D1E0000-0x0000015E7D1F0000-memory.dmp