902535c8dc8216770afa0d60fac3e8054dea9ed1569bc579cbe00b0b1d377b68

Analysis

max time kernel
1355s
max time network
1146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gta 3/Setap-Filess/plugins/access/libfilesystem_plugin.dll
Size

59KB
MD5

8fac15d2a2da66abdf345afa45ac5e3b
SHA1

553d4c9f39726d8aadb15fed7c904048928049e0
SHA256

66ef741a9282b420b09b940fbdbf666cd1625a8da18daaece036fcc4e1a74d38
SHA512

f756e3b3368245d4670cf0f86a6727858e3ead983b3e10c11d9b13e67d86b632703f44df70e648bb8edcad295744c763a268f4eb02ace0055405c3e9af124548
SSDEEP

768:D2y9ohNIged8Yy0NBdeOWxRPxYoWE487KcxN5ZEUUaDGFheDGFhW:D2yyhkKYloRPuEUcxHZEUUe

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4232 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4232	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3324 wrote to memory of 1456	3324	rundll32.exe	rundll32.exe
PID 3324 wrote to memory of 1456	3324	rundll32.exe	rundll32.exe
PID 3324 wrote to memory of 1456	3324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\plugins\access\libfilesystem_plugin.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\plugins\access\libfilesystem_plugin.dll",#1
  2⤵
  PID:1456

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4232-0-0x0000018549490000-0x00000185494A0000-memory.dmp

Filesize
64KB

Download
memory/4232-16-0x0000018549590000-0x00000185495A0000-memory.dmp

Filesize
64KB

Download
memory/4232-32-0x0000018551B80000-0x0000018551B81000-memory.dmp

Filesize
4KB

Download
memory/4232-33-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-34-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-35-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-36-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-37-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-38-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-39-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-40-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-41-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-42-0x0000018551BA0000-0x0000018551BA1000-memory.dmp

Filesize
4KB

Download
memory/4232-43-0x00000185517D0000-0x00000185517D1000-memory.dmp

Filesize
4KB

Download
memory/4232-44-0x00000185517C0000-0x00000185517C1000-memory.dmp

Filesize
4KB

Download
memory/4232-46-0x00000185517D0000-0x00000185517D1000-memory.dmp

Filesize
4KB

Download
memory/4232-49-0x00000185517C0000-0x00000185517C1000-memory.dmp

Filesize
4KB

Download
memory/4232-52-0x0000018551700000-0x0000018551701000-memory.dmp

Filesize
4KB

Download
memory/4232-64-0x0000018551900000-0x0000018551901000-memory.dmp

Filesize
4KB

Download
memory/4232-66-0x0000018551910000-0x0000018551911000-memory.dmp

Filesize
4KB

Download
memory/4232-67-0x0000018551910000-0x0000018551911000-memory.dmp

Filesize
4KB

Download
memory/4232-68-0x0000018551A20000-0x0000018551A21000-memory.dmp

Filesize
4KB

Download