Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 01:33

General

  • Target

    6eb3b2125a126862766307070afbd35b012850563523bdda2ce3cfe952af6fdb.exe

  • Size

    14.0MB

  • MD5

    601cedc4e5ec2d83b8df1f2a9834528e

  • SHA1

    f5e3b1a522bc4f705c87aa853384e53b7378de05

  • SHA256

    6eb3b2125a126862766307070afbd35b012850563523bdda2ce3cfe952af6fdb

  • SHA512

    045757ccbc0c8f367c600ed94eff932cf753b5a793f274e681a31eb2f2b13b27ea8c1031841e319f0447ccdcf296e8ee77065050425fd85a380a90dea54b1101

  • SSDEEP

    98304:Rhcqnt8zi8o5jX24Y/fmLaZv7x4iPdL0zKcKv9QZIaGSNLQKlgzmRXkWe:RHntxX24Y/Vd131LIbZIpSLQKiik

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eb3b2125a126862766307070afbd35b012850563523bdda2ce3cfe952af6fdb.exe
    "C:\Users\Admin\AppData\Local\Temp\6eb3b2125a126862766307070afbd35b012850563523bdda2ce3cfe952af6fdb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tcentretmp\EntityFramework.dll

    Filesize

    4.8MB

    MD5

    ffdcf232d0bb2fff78721fb347641a76

    SHA1

    54c76a2fa61e6df1ae4c9df65435a38482c2cb71

    SHA256

    ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2

    SHA512

    89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1

  • memory/1632-3-0x0000000005C80000-0x0000000005D12000-memory.dmp

    Filesize

    584KB

  • memory/1632-18-0x0000000009200000-0x00000000092B0000-memory.dmp

    Filesize

    704KB

  • memory/1632-0-0x000000007448E000-0x000000007448F000-memory.dmp

    Filesize

    4KB

  • memory/1632-10-0x0000000074480000-0x0000000074C30000-memory.dmp

    Filesize

    7.7MB

  • memory/1632-9-0x0000000005EB0000-0x0000000005EBA000-memory.dmp

    Filesize

    40KB

  • memory/1632-1-0x0000000000440000-0x000000000123A000-memory.dmp

    Filesize

    14.0MB

  • memory/1632-14-0x0000000009470000-0x0000000009936000-memory.dmp

    Filesize

    4.8MB

  • memory/1632-2-0x0000000006330000-0x00000000068D4000-memory.dmp

    Filesize

    5.6MB

  • memory/1632-19-0x0000000009320000-0x0000000009342000-memory.dmp

    Filesize

    136KB

  • memory/1632-20-0x0000000009940000-0x0000000009C94000-memory.dmp

    Filesize

    3.3MB

  • memory/1632-23-0x0000000074480000-0x0000000074C30000-memory.dmp

    Filesize

    7.7MB

  • memory/1632-22-0x000000000BA10000-0x000000000BA66000-memory.dmp

    Filesize

    344KB

  • memory/1632-24-0x000000007448E000-0x000000007448F000-memory.dmp

    Filesize

    4KB

  • memory/1632-25-0x0000000074480000-0x0000000074C30000-memory.dmp

    Filesize

    7.7MB