Analysis
-
max time kernel
139s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 11:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
Client.exe
-
Size
169KB
-
MD5
25291bd76d119ddc6eb07f2fe2fa3488
-
SHA1
306fbacaf20e9cf43caa3d59e5a0a859932b6652
-
SHA256
14f9d6d20222a1b9824dd22e6173731b934dfbf1670f8228f740a8a2e3b824f0
-
SHA512
031ae88bf3b88cd602bbb8a1dbc313d5ce1317cf390116b3115a44e5990e06abdaaa72c8f81f6e63ffe9af78edf36c1dc18d4f5f044143518e8f9e94d14b5706
-
SSDEEP
3072:NJgG6EsvKxZfa4kDoYuw1bm+cKc8Beaim9bArt1GwSYvTwel:Q1EsIZfaR/K8him9bct1
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 api.ipify.org -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Client.exepid process 640 Client.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Client.exedescription pid process Token: SeDebugPrivilege 640 Client.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmpFilesize
4KB
-
memory/640-1-0x0000000000950000-0x0000000000980000-memory.dmpFilesize
192KB
-
memory/640-2-0x0000000005920000-0x0000000005EC4000-memory.dmpFilesize
5.6MB
-
memory/640-3-0x0000000005230000-0x00000000052C2000-memory.dmpFilesize
584KB
-
memory/640-4-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/640-5-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/640-7-0x0000000007B70000-0x0000000007B82000-memory.dmpFilesize
72KB
-
memory/640-8-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/640-9-0x0000000074E4E000-0x0000000074E4F000-memory.dmpFilesize
4KB
-
memory/640-10-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/640-11-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB