Resubmissions
30/05/2024, 08:19
240530-j76t7acf661030/05/2024, 08:16
240530-j6cjyscf331030/05/2024, 08:10
240530-j244eabe3t1030/05/2024, 07:54
240530-jrx74scc3710Analysis
- max time kernel
0s - max time network
5s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
30/05/2024, 08:19
General
- Target Growtoken.exe
- Size 1.2MB
- Sample240530-j76t7acf66
- SHA256 d44006982388af1f774550e394ebc9a613bbccd2e0dbedfdac871fee1872ad96
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer 1 IoCs
- Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_z1tl12qd.2lq.ps1
dcd.exe
memory/3068-4-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-1-0x0000000000B40000-0x0000000000C4E000-memory.dmp
memory/3068-0-0x00007FFD2F253000-0x00007FFD2F255000-memory.dmp
memory/3068-5-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-6-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-2-0x000000001B870000-0x000000001B8C0000-memory.dmp
memory/3068-11-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-12-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-13-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/3068-3-0x000000001B820000-0x000000001B85E000-memory.dmp
memory/4696-14-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/4696-24-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/4696-23-0x000001F1295F0000-0x000001F129612000-memory.dmp
memory/4696-25-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/4696-26-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/4696-27-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp
memory/4696-30-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp