Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 04:07
General
- Target 5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe
- Size 1.5MB
- Sample240612-epp2ha1ajk
- SHA256 5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsh32E8.tmp\RAVAntivirus-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsh32E8.tmp\RAVAntivirus-installer.exe" "C:\Users\Admin\AppData\Local\Temp\5edf82763a3b79627af5456f1c678b136a3cb700d1d8221ed2aa1f19a53028bd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RAVAntivirus-installer.exe
rsAtom.dll
rsJSON.dll
rsLogger.dll
rsStubLib.dll
memory/1640-54-0x0000021020390000-0x00000210203BE000-memory.dmp
memory/1640-55-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-45-0x0000021006350000-0x0000021006380000-memory.dmp
memory/1640-49-0x000002101EB30000-0x000002101EB68000-memory.dmp
memory/1640-50-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-51-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-52-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-43-0x0000021004600000-0x0000021004682000-memory.dmp
memory/1640-42-0x00007FF96F9C3000-0x00007FF96F9C5000-memory.dmp
memory/1640-47-0x0000021006380000-0x00000210063AE000-memory.dmp
memory/1640-56-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-57-0x0000021020860000-0x0000021020868000-memory.dmp
memory/1640-59-0x00000210206D0000-0x00000210206DE000-memory.dmp
memory/1640-60-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-58-0x0000021020700000-0x0000021020738000-memory.dmp
memory/1640-61-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-62-0x00007FF96F9C3000-0x00007FF96F9C5000-memory.dmp
memory/1640-63-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-64-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp
memory/1640-65-0x00007FF96F9C0000-0x00007FF970481000-memory.dmp