Analysis
- max time kernel
141s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 04:27
General
- Target e5f70b4133a9ac6d8f45eb8fb5a5707a5777cae63eef549e6b1d4245e9707279.exe
- Size 445KB
- Sample240611-e3dwdsthkd
- SHA256 e5f70b4133a9ac6d8f45eb8fb5a5707a5777cae63eef549e6b1d4245e9707279
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f70b4133a9ac6d8f45eb8fb5a5707a5777cae63eef549e6b1d4245e9707279.exe"C:\Users\Admin\AppData\Local\Temp\e5f70b4133a9ac6d8f45eb8fb5a5707a5777cae63eef549e6b1d4245e9707279.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Build\Isass.exe"C:\Program Files (x86)\Microsoft Build\Isass.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Isass.exe
integrator.exe
memory/2120-4-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/2120-5-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-20-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-27-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-9-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-10-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-11-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-6-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-7-0x0000000001BF0000-0x0000000001BF1000-memory.dmp
memory/4604-8-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-28-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-29-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-30-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-31-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-32-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-40-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-41-0x0000000000400000-0x00000000016A7000-memory.dmp
memory/4604-42-0x0000000000400000-0x00000000016A7000-memory.dmp