3981304ae7cc29ceabc5c6286b9c690915c270900d2a78464fa22f6f56729563

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Size

12.6MB
MD5

19aa54a30ff7cdf81c177161976e6cd1
SHA1

605f4d808387e68475e6fc6bc6972bfe55e8a4c8
SHA256

3981304ae7cc29ceabc5c6286b9c690915c270900d2a78464fa22f6f56729563
SHA512

29a3ce73408da7c9c06d13511fb06c85cf8c41fce4fd192f5c150bd498caef05ea3b144fa6cdf6e7043250065bb00d2252874c9bee1bf1b888a67b23d42c3cff
SSDEEP

393216:1UFKsMorXmYwtQQlTX3zxPYvkS8Yy/CmnL4:18ZXmYw6AT1QExn

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

pid process

2280 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

12 discord.com
13 discord.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 2280 WerFault.exe 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

description pid process

Token: SeDebugPrivilege 2280 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

pid	process
2280	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

flow	ioc
12	discord.com
13	discord.com

pid	pid_target	process	target process
3688	2280	WerFault.exe	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

description	pid	process
Token: SeDebugPrivilege	2280	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1768
2⤵
- Program crash
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2280 -ip 2280
1⤵
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll
Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
memory/2280-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x0000000000EA0000-0x0000000001B42000-memory.dmp

Filesize
12.6MB

Download
memory/2280-2-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download
memory/2280-8-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download