Overview

overview

7

Static

static

3

incognito/...au.dll

windows7-x64

7

incognito/...au.dll

windows10-2004-x64

7

incognito/...it.exe

windows7-x64

7

incognito/...it.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    1563s
  • max time network
    1571s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 15:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    incognito/bin/incognito-luau.dll

  • Size

    1.3MB

  • MD5

    157fd035b2a344a94166d7db3756df0e

  • SHA1

    f221d28c1deb80b4e8d9201226435aefce6b0f75

  • SHA256

    8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009

  • SHA512

    fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d

  • SSDEEP

    24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\incognito\bin\incognito-luau.dll,#1
    1⤵
      PID:2888
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1516
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap5584:90:7zEvent22044 -tzip -sae -- "C:\Users\Admin\AppData\Local\Temp\incognito.zip"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2436
      • C:\Users\Admin\AppData\Local\Temp\incognito\thegreatestexploit.exe
        "C:\Users\Admin\AppData\Local\Temp\incognito\thegreatestexploit.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:580
        • C:\Users\Admin\AppData\Local\Temp\onefile_580_133612964334522000\incognito.exe
          "C:\Users\Admin\AppData\Local\Temp\incognito\thegreatestexploit.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1924

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\onefile_580_133612964334522000\python311.dll
        Filesize

        5.5MB

        MD5

        9a24c8c35e4ac4b1597124c1dcbebe0f

        SHA1

        f59782a4923a30118b97e01a7f8db69b92d8382a

        SHA256

        a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

        SHA512

        9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\onefile_580_133612964334522000\incognito.exe
        Filesize

        30.3MB

        MD5

        e988f89594fc2de75f8ad3e3297ae613

        SHA1

        421d4df07aeaa5ff86452cf07b26f418ac8c380f

        SHA256

        82e9b402d43b98c46188968af43976d0363613563322f0cf442c06bf4198e852

        SHA512

        f44f12415de9e6c9bd248aebd498ec5e6d53949dcdfe5b7b52e463050f607c78b152145d78b19c439f75ccc48a6e2576b53b33e44856765331c7fd4244530dd6

        Download Submit