Analysis
- max time kernel
118s - max time network
123s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
- submitted
12/06/2024, 04:07
General
- Target 5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe
- Size 1.5MB
- Sample240612-epp2ha1ajk
- SHA256 5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsd742.tmp\RAVAntivirus-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsd742.tmp\RAVAntivirus-installer.exe" "C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab1190.tmp
Tar11F4.tmp
rsAtom.dll
rsJSON.dll
rsLogger.dll
rsStubLib.dll
RAVAntivirus-installer.exe
memory/2576-48-0x0000000000500000-0x000000000052E000-memory.dmp
memory/2576-58-0x00000000021C0000-0x00000000021CA000-memory.dmp
memory/2576-51-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-52-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-53-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-46-0x00000000004D0000-0x0000000000500000-memory.dmp
memory/2576-55-0x00000000020D0000-0x00000000020FE000-memory.dmp
memory/2576-56-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-57-0x00000000021C0000-0x00000000021CA000-memory.dmp
memory/2576-50-0x0000000001FE0000-0x0000000002018000-memory.dmp
memory/2576-59-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-60-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-44-0x0000000000340000-0x00000000003C2000-memory.dmp
memory/2576-43-0x000007FEF5CB3000-0x000007FEF5CB4000-memory.dmp
memory/2576-125-0x000007FEF5CB3000-0x000007FEF5CB4000-memory.dmp
memory/2576-126-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-128-0x00000000021C0000-0x00000000021CA000-memory.dmp
memory/2576-127-0x00000000021C0000-0x00000000021CA000-memory.dmp
memory/2576-129-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp
memory/2576-130-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp