4191ad6b7c669b7566bc56bb517b9a080c2a1b7c6b04c3a9bc48a845c440a433

Analysis

max time kernel
150s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-04-2024 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OrteliaCurator.exe
Size

635KB
MD5

f42024f641f5fa36b4ec8b7646cd737f
SHA1

38d0933b5a0ab5a66bd3b9c13518c8f0eeeed5ba
SHA256

e1a6ebc1df855faa253e4c52fc7cd8455866d1abcd88d0c09c8eac441f878602
SHA512

d6eacd342cab364a547066a91269c84cb780062df44125116bb11cd7a3f62d2fbc45b9a3276cecd1df772e7457875bc021a2f6276475256b3bc471a0e0602ead
SSDEEP

3072:oys7oYfSbbQTLWuiUg7VsS4jMJN0R+fSggy2h03o+K:o/7oYfSHQPWTUg4/vggy2hAof

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3596 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3596 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OrteliaCurator.exe

pid process

3604 OrteliaCurator.exe

description	pid	process
Token: 33	3596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3596	AUDIODG.EXE

pid	process
3604	OrteliaCurator.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OrteliaCurator.exe

description	pid	process	target process
PID 3604 wrote to memory of 824	3604	OrteliaCurator.exe	UnityCrashHandler64.exe
PID 3604 wrote to memory of 824	3604	OrteliaCurator.exe	UnityCrashHandler64.exe

C:\Users\Admin\AppData\Local\Temp\OrteliaCurator.exe
"C:\Users\Admin\AppData\Local\Temp\OrteliaCurator.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 3604 1498601426944
2⤵
PID:824

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-0-0x0000015CED390000-0x0000015CED3A0000-memory.dmp

Filesize
64KB

Download
memory/3604-1-0x0000015CEB9E0000-0x0000015CEB9F0000-memory.dmp

Filesize
64KB

Download
memory/3604-4-0x0000015E4EF40000-0x0000015E4EF50000-memory.dmp

Filesize
64KB

Download
memory/3604-5-0x0000015E4EF50000-0x0000015E4EF60000-memory.dmp

Filesize
64KB

Download
memory/3604-7-0x0000015ED9720000-0x0000015ED9730000-memory.dmp

Filesize
64KB

Download
memory/3604-6-0x0000015E985A0000-0x0000015E985B0000-memory.dmp

Filesize
64KB

Download
memory/3604-8-0x0000015ED9170000-0x0000015ED9180000-memory.dmp

Filesize
64KB

Download
memory/3604-10-0x0000015ED9180000-0x0000015ED9190000-memory.dmp

Filesize
64KB

Download
memory/3604-12-0x0000015ED9210000-0x0000015ED9220000-memory.dmp

Filesize
64KB

Download
memory/3604-13-0x0000015ED9220000-0x0000015ED9230000-memory.dmp

Filesize
64KB

Download
memory/3604-14-0x0000015ED9230000-0x0000015ED9240000-memory.dmp

Filesize
64KB

Download
memory/3604-15-0x0000015ED9290000-0x0000015ED92A0000-memory.dmp

Filesize
64KB

Download
memory/3604-16-0x0000015CED390000-0x0000015CED3A0000-memory.dmp

Filesize
64KB

Download
memory/3604-17-0x0000015CEB9E0000-0x0000015CEB9F0000-memory.dmp

Filesize
64KB

Download
memory/3604-19-0x0000015ED9430000-0x0000015ED9440000-memory.dmp

Filesize
64KB

Download
memory/3604-18-0x0000015ED9340000-0x0000015ED9350000-memory.dmp

Filesize
64KB

Download
memory/3604-20-0x0000015ED9450000-0x0000015ED9460000-memory.dmp

Filesize
64KB

Download
memory/3604-21-0x0000015ED9440000-0x0000015ED9450000-memory.dmp

Filesize
64KB

Download
memory/3604-22-0x0000015E4EF50000-0x0000015E4EF60000-memory.dmp

Filesize
64KB

Download
memory/3604-23-0x0000015ED9460000-0x0000015ED9470000-memory.dmp

Filesize
64KB

Download
memory/3604-25-0x0000015E985A0000-0x0000015E985B0000-memory.dmp

Filesize
64KB

Download
memory/3604-26-0x0000015ED9720000-0x0000015ED9730000-memory.dmp

Filesize
64KB

Download
memory/3604-27-0x0000015ED9480000-0x0000015ED9490000-memory.dmp

Filesize
64KB

Download
memory/3604-29-0x0000015ED9170000-0x0000015ED9180000-memory.dmp

Filesize
64KB

Download
memory/3604-28-0x0000015ED9490000-0x0000015ED94A0000-memory.dmp

Filesize
64KB

Download
memory/3604-30-0x0000015ED9180000-0x0000015ED9190000-memory.dmp

Filesize
64KB

Download
memory/3604-32-0x0000015ED94B0000-0x0000015ED94C0000-memory.dmp

Filesize
64KB

Download
memory/3604-33-0x0000015ED94C0000-0x0000015ED94D0000-memory.dmp

Filesize
64KB

Download
memory/3604-31-0x0000015ED94A0000-0x0000015ED94B0000-memory.dmp

Filesize
64KB

Download
memory/3604-35-0x0000015ED9210000-0x0000015ED9220000-memory.dmp

Filesize
64KB

Download
memory/3604-34-0x0000015ED9600000-0x0000015ED9610000-memory.dmp

Filesize
64KB

Download
memory/3604-24-0x0000015ED9470000-0x0000015ED9480000-memory.dmp

Filesize
64KB

Download
memory/3604-36-0x0000015ED9610000-0x0000015ED9630000-memory.dmp

Filesize
128KB

Download
memory/3604-37-0x0000015ED9630000-0x0000015ED9640000-memory.dmp

Filesize
64KB

Download
memory/3604-38-0x0000015E53AB0000-0x0000015E53AC0000-memory.dmp

Filesize
64KB

Download
memory/3604-39-0x0000015ED9220000-0x0000015ED9230000-memory.dmp

Filesize
64KB

Download
memory/3604-40-0x0000015ED9230000-0x0000015ED9240000-memory.dmp

Filesize
64KB

Download
memory/3604-41-0x0000015ED9290000-0x0000015ED92A0000-memory.dmp

Filesize
64KB

Download
memory/3604-42-0x0000015ED9340000-0x0000015ED9350000-memory.dmp

Filesize
64KB

Download
memory/3604-44-0x0000015ED9450000-0x0000015ED9460000-memory.dmp

Filesize
64KB

Download
memory/3604-43-0x0000015ED9430000-0x0000015ED9440000-memory.dmp

Filesize
64KB

Download
memory/3604-45-0x0000015ED9440000-0x0000015ED9450000-memory.dmp

Filesize
64KB

Download
memory/3604-46-0x0000015ED9460000-0x0000015ED9470000-memory.dmp

Filesize
64KB

Download
memory/3604-47-0x0000015ED9480000-0x0000015ED9490000-memory.dmp

Filesize
64KB

Download
memory/3604-48-0x0000015ED9470000-0x0000015ED9480000-memory.dmp

Filesize
64KB

Download
memory/3604-49-0x0000015ED9490000-0x0000015ED94A0000-memory.dmp

Filesize
64KB

Download
memory/3604-50-0x0000015ED94A0000-0x0000015ED94B0000-memory.dmp

Filesize
64KB

Download
memory/3604-51-0x0000015ED94C0000-0x0000015ED94D0000-memory.dmp

Filesize
64KB

Download