Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11-05-2024 00:51
General
-
Target
Sorillus-Launcher v1.1.exe
-
Size
1.2MB
-
MD5
85cecea8cd99baa57decdeddd6c7f800
-
SHA1
43af40ab8eb41cb02fed8d223c5098e2fb15c2d8
-
SHA256
43d005cf6b3c5883e6a5bca5aa4863ad46477b0b79f68dc0a907dd8cfaf280e2
-
SHA512
d104dae2510cbe79a2b7a21e7156d80ed2a131ef701204590f8e739145ffa8c9cf1985c9f1360816788e62ff378ef3b7c80c7badec66e65fd30364f0ee0f633a
-
SSDEEP
24576:vPZl0enBpHMy5zUdw4GRqemkilngx69BVx2YqXId228r9AtyeeSyj:wSGy5zOw4hVh10W4Y+r9Aty/
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Djavafx.animation.fullspeed=true -jar "C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5e827291d23a7228b2cea29376fe0537f
SHA15f981d0a2a9319f914550798f41fc4ffd7308e53
SHA256a402b2924f3a4314f613ba58d9c1302f2b666c3cabc758ca5d66527598d3e14f
SHA5126eff88cc7098702aa2749f0fd63e2ee3d3b1c873030442e0c339fbd0bcaf13bd6cb88ebd29e0bde741a8c0d236ec0724f0a30fc44f8805bcdc62e9d32a3cffcc
-
Filesize
9KB
MD5b0366e31f3704da1e9552633a07f77db
SHA1fd3058cc08a5e00b56301dc44e0e05854a5e55ea
SHA25618f1f5afec89f152afe1c57cffe9a77c158d840f6e00ec7a343b685caa3d8853
SHA512d8e621eb9b15103a70544affbd7e3fdf52fe14bdae754fd9551508ed8785d53b6205082de41a575acffe5d1c80d419eda16d79834fdbad9cc8df798dcaa4eaa4
-
Filesize
256KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB