Analysis
- max time kernel
193s - max time network
215s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 14:57
General
- Target f63c3c0347e1b4f9b13b02fd86cd7be749ab29fc313666e2047354336bd42fbf.ps1
- Size 154KB
- Sample240410-sbrj3aca78
- SHA256 f63c3c0347e1b4f9b13b02fd86cd7be749ab29fc313666e2047354336bd42fbf
Malware Config
Extracted
-
diceloader
-
185.172.129.70
-
162.248.225.148
Signatures
- DiceLoader
DiceLoader is a loader written in C++.
- Blocklisted process makes network request 11 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f63c3c0347e1b4f9b13b02fd86cd7be749ab29fc313666e2047354336bd42fbf.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ple33kp2.cb4.ps1
memory/1580-14-0x000001F49A480000-0x000001F49A490000-memory.dmp
memory/1580-10-0x00007FFC05FB0000-0x00007FFC06A71000-memory.dmp
memory/1580-11-0x000001F49A480000-0x000001F49A490000-memory.dmp
memory/1580-12-0x000001F49A480000-0x000001F49A490000-memory.dmp
memory/1580-13-0x00007FFC05FB0000-0x00007FFC06A71000-memory.dmp
memory/1580-0-0x000001F4B48F0000-0x000001F4B4912000-memory.dmp
memory/1580-15-0x000001F49A480000-0x000001F49A490000-memory.dmp
memory/1580-17-0x000001F4B48C0000-0x000001F4B48C7000-memory.dmp
memory/1580-16-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp
memory/1580-19-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp
memory/1580-20-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp
memory/1580-21-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp
memory/1580-22-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp
memory/1580-23-0x000001F4B48D0000-0x000001F4B48D6000-memory.dmp