Analysis
- max time kernel
119s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/05/2024, 15:16
General
- Target Installer.exe
- Size 165.3MB
- Sample240509-snv31sbd49
- SHA256 7e6a34eb765d6a834b8dbdacd69a94180852d06816cc46ed5e7fee34a32c9752
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2964 -s 24402⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/2964-51-0x0000000004610000-0x0000000004960000-memory.dmp
memory/2964-11-0x000000000C200000-0x0000000011250000-memory.dmp
memory/2964-26-0x0000000001C60000-0x0000000001C70000-memory.dmp
memory/2964-22-0x0000000003E30000-0x0000000003F40000-memory.dmp
memory/2964-34-0x00000001400E5000-0x00000001400E6000-memory.dmp
memory/2964-55-0x0000000002660000-0x00000000026B0000-memory.dmp
memory/2964-59-0x00000000026B0000-0x00000000026C0000-memory.dmp
memory/2964-5-0x0000000002C70000-0x0000000003090000-memory.dmp
memory/2964-67-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/2964-30-0x0000000003090000-0x0000000003120000-memory.dmp
memory/2964-63-0x0000000004960000-0x0000000004970000-memory.dmp
memory/2964-47-0x0000000002010000-0x0000000002030000-memory.dmp
memory/2964-43-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/2964-39-0x0000000001D50000-0x0000000001D60000-memory.dmp
memory/2964-35-0x0000000001D10000-0x0000000001D30000-memory.dmp
memory/2964-14-0x0000000001C10000-0x0000000001C50000-memory.dmp
memory/2964-18-0x0000000003870000-0x0000000003E30000-memory.dmp
memory/2964-183-0x0000000005BD0000-0x0000000005BDA000-memory.dmp
memory/2964-252-0x00000001400E5000-0x00000001400E6000-memory.dmp