Analysis
- max time kernel
141s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 01:55
General
- Target 30691ddf62f3e466001e601147e174c3.exe
- Size 17.4MB
- Sample240611-cb55fszgrm
- SHA256 25a478be27105216efb97bf7233fe814c9d0ef1c82fa6e62009b0e94796fa41a
Malware Config
Signatures
- Loads dropped DLL 57 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30691ddf62f3e466001e601147e174c3.exe"C:\Users\Admin\AppData\Local\Temp\30691ddf62f3e466001e601147e174c3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30691ddf62f3e466001e601147e174c3.exe"C:\Users\Admin\AppData\Local\Temp\30691ddf62f3e466001e601147e174c3.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ecb.pyd
_raw_ofb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
md.cp310-win_amd64.pyd
md__mypyc.cp310-win_amd64.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python310.dll
pythoncom310.dll
pywintypes310.dll
select.pyd
sqlite3.dll
unicodedata.pyd
win32api.pyd
memory/1616-153-0x00007FFE90200000-0x00007FFE90234000-memory.dmp
memory/1616-214-0x00007FFE8FFB0000-0x00007FFE8FFBC000-memory.dmp
memory/1616-163-0x00007FFE90990000-0x00007FFE9099A000-memory.dmp
memory/1616-164-0x00007FFE90950000-0x00007FFE90974000-memory.dmp
memory/1616-169-0x00007FFE904C0000-0x00007FFE904DC000-memory.dmp
memory/1616-168-0x00007FFE96510000-0x00007FFE96529000-memory.dmp
memory/1616-160-0x00007FFE80FE0000-0x00007FFE8144E000-memory.dmp
memory/1616-156-0x00007FFE91050000-0x00007FFE9105D000-memory.dmp
memory/1616-180-0x0000019B3F060000-0x0000019B3F3D5000-memory.dmp
memory/1616-179-0x00007FFE909C0000-0x00007FFE909EE000-memory.dmp
memory/1616-150-0x00007FFE907D0000-0x00007FFE907FB000-memory.dmp
memory/1616-147-0x00007FFE90800000-0x00007FFE908BC000-memory.dmp
memory/1616-141-0x00007FFE909A0000-0x00007FFE909B9000-memory.dmp
memory/1616-207-0x00007FFE904B0000-0x00007FFE904BB000-memory.dmp
memory/1616-206-0x00007FFE90910000-0x00007FFE9091B000-memory.dmp
memory/1616-142-0x00007FFE90920000-0x00007FFE9094D000-memory.dmp
memory/1616-204-0x00007FFE90080000-0x00007FFE9009F000-memory.dmp
memory/1616-203-0x00007FFE907D0000-0x00007FFE907FB000-memory.dmp
memory/1616-202-0x00007FFE80EC0000-0x00007FFE80FD8000-memory.dmp
memory/1616-136-0x00007FFE909C0000-0x00007FFE909EE000-memory.dmp
memory/1616-199-0x00007FFE80D40000-0x00007FFE80EB1000-memory.dmp
memory/1616-132-0x00007FFE945A0000-0x00007FFE945AD000-memory.dmp
memory/1616-194-0x00007FFE8FFE0000-0x00007FFE90003000-memory.dmp
memory/1616-191-0x00007FFE90800000-0x00007FFE908BC000-memory.dmp
memory/1616-190-0x00007FFE90980000-0x00007FFE9098B000-memory.dmp
memory/1616-189-0x00007FFE900A0000-0x00007FFE900B4000-memory.dmp
memory/1616-129-0x00007FFE96510000-0x00007FFE96529000-memory.dmp
memory/1616-186-0x00007FFE90920000-0x00007FFE9094D000-memory.dmp
memory/1616-124-0x00007FFE90950000-0x00007FFE90974000-memory.dmp
memory/1616-178-0x00007FFE814F0000-0x00007FFE81865000-memory.dmp
memory/1616-177-0x00007FFE900C0000-0x00007FFE90178000-memory.dmp
memory/1616-174-0x00007FFE90180000-0x00007FFE901AE000-memory.dmp
memory/1616-125-0x00007FFE99D10000-0x00007FFE99D1F000-memory.dmp
memory/1616-211-0x00007FFE8FFD0000-0x00007FFE8FFDC000-memory.dmp
memory/1616-115-0x00007FFE80FE0000-0x00007FFE8144E000-memory.dmp
memory/1616-212-0x00007FFE90990000-0x00007FFE9099A000-memory.dmp
memory/1616-213-0x00007FFE8FFC0000-0x00007FFE8FFCB000-memory.dmp
memory/1616-162-0x00007FFE901B0000-0x00007FFE901F2000-memory.dmp
memory/1616-215-0x00007FFE8FFA0000-0x00007FFE8FFAB000-memory.dmp
memory/1616-216-0x00007FFE900C0000-0x00007FFE90178000-memory.dmp
memory/1616-217-0x00007FFE814F0000-0x00007FFE81865000-memory.dmp
memory/1616-224-0x00007FFE8E450000-0x00007FFE8E45C000-memory.dmp
memory/1616-225-0x00007FFE90180000-0x00007FFE901AE000-memory.dmp
memory/1616-231-0x00007FFE8E400000-0x00007FFE8E40C000-memory.dmp
memory/1616-230-0x00007FFE8E430000-0x00007FFE8E43D000-memory.dmp
memory/1616-229-0x00007FFE8E410000-0x00007FFE8E422000-memory.dmp
memory/1616-228-0x00007FFE8E440000-0x00007FFE8E44C000-memory.dmp
memory/1616-227-0x00007FFE8FEC0000-0x00007FFE8FECD000-memory.dmp
memory/1616-226-0x0000019B3F060000-0x0000019B3F3D5000-memory.dmp
memory/1616-223-0x00007FFE8F170000-0x00007FFE8F17B000-memory.dmp
memory/1616-232-0x00007FFE80D40000-0x00007FFE80EB1000-memory.dmp
memory/1616-239-0x00007FFE81CB0000-0x00007FFE81CF1000-memory.dmp
memory/1616-238-0x00007FFE81D80000-0x00007FFE81D95000-memory.dmp
memory/1616-241-0x00007FFE81D60000-0x00007FFE81D7C000-memory.dmp
memory/1616-240-0x00007FFE8A6A0000-0x00007FFE8A6AE000-memory.dmp
memory/1616-237-0x00007FFE870A0000-0x00007FFE870B3000-memory.dmp
memory/1616-236-0x00007FFE870C0000-0x00007FFE870DC000-memory.dmp
memory/1616-235-0x00007FFE870E0000-0x00007FFE870F4000-memory.dmp
memory/1616-234-0x00007FFE8A6B0000-0x00007FFE8A6C0000-memory.dmp
memory/1616-233-0x00007FFE8A6C0000-0x00007FFE8A6D5000-memory.dmp
memory/1616-222-0x00007FFE8F7C0000-0x00007FFE8F7CB000-memory.dmp
memory/1616-221-0x00007FFE8F7D0000-0x00007FFE8F7DC000-memory.dmp
memory/1616-220-0x00007FFE8F7E0000-0x00007FFE8F7EC000-memory.dmp
memory/1616-219-0x00007FFE8F7F0000-0x00007FFE8F7FE000-memory.dmp
memory/1616-218-0x00007FFE8FF80000-0x00007FFE8FF8C000-memory.dmp
memory/1616-242-0x00007FFE81AE0000-0x00007FFE81B09000-memory.dmp
memory/1616-243-0x00007FFE904B0000-0x00007FFE904BB000-memory.dmp
memory/1616-245-0x00007FFE90950000-0x00007FFE90974000-memory.dmp
memory/1616-247-0x00007FFE96510000-0x00007FFE96529000-memory.dmp
memory/1616-244-0x00007FFE80FE0000-0x00007FFE8144E000-memory.dmp
memory/1616-294-0x00007FFE81CB0000-0x00007FFE81CF1000-memory.dmp
memory/1616-293-0x00007FFE870A0000-0x00007FFE870B3000-memory.dmp
memory/1616-292-0x00007FFE870C0000-0x00007FFE870DC000-memory.dmp