Resubmissions
24/12/2024, 19:02
241224-xp5fastrdy1016/07/2024, 19:04
240716-xq4v6aydlf16/07/2024, 19:00
240716-xn2b9avhmm1029/04/2024, 18:50
240429-xhbjmsac4x1029/04/2024, 18:47
240429-xffetahh2310Analysis
- max time kernel
111s - max time network
90s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
29/04/2024, 18:47
General
- Target sero.zip
- Size 7.9MB
- Sample240429-xffetahh23
- SHA256 480f683d425ef49564b7506f057daae3a42f080915101afe0178768128761249
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sero.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\BRUH WTF\bin\SeroXen.exe"C:\Users\Admin\Desktop\BRUH WTF\bin\SeroXen.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\BRUH WTF\SeroXen.exe"C:\Users\Admin\Desktop\BRUH WTF\SeroXen.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\BRUH WTF\bin\SeroXen.exe"C:\Users\Admin\Desktop\BRUH WTF\bin\SeroXen.exe" Launch2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SeroXen.exe.log
__PSScriptPolicyTest_bnisoeq3.qhp.ps1
memory/536-21-0x000001A9F1170000-0x000001A9F11AE000-memory.dmp
memory/536-20-0x000001A9EF760000-0x000001A9EF79C000-memory.dmp
memory/536-19-0x000001A9EF350000-0x000001A9EF3A8000-memory.dmp
memory/1020-3-0x00000129F65A0000-0x00000129F65B0000-memory.dmp
memory/1020-14-0x00007FFF6DF00000-0x00007FFF6DF19000-memory.dmp
memory/1020-16-0x00007FFF5BDC0000-0x00007FFF5C881000-memory.dmp
memory/1020-17-0x00007FFF6DF00000-0x00007FFF6DF19000-memory.dmp
memory/1020-13-0x00000129F7200000-0x00000129F7222000-memory.dmp
memory/1020-0-0x00000129F4980000-0x00000129F49E4000-memory.dmp
memory/1020-2-0x00007FFF5BDC0000-0x00007FFF5C881000-memory.dmp
memory/1020-1-0x00000129F7360000-0x00000129F7722000-memory.dmp
memory/2896-31-0x00000251F7B10000-0x00000251F7B28000-memory.dmp