Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 10:48
General
- Target KOSTCO OFFER REF 440724.scr.exe
- Size 1.1MB
- Sample240613-mv4e3szbll
- SHA256 920f4d1b63a2616e2616ee73bce3bd283284c73806603a7e41fedb19b36d4fef
Malware Config
Signatures
- Suspicious use of SetThreadContext 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"C:\Users\Admin\AppData\Local\Temp\KOSTCO OFFER REF 440724.scr.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\w32tm.exe"C:\Windows\SysWOW64\w32tm.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-28-0x00000000006C0000-0x00000000006FF000-memory.dmp
memory/952-26-0x0000000000E50000-0x0000000000EF0000-memory.dmp
memory/952-25-0x00000000006C0000-0x00000000006FF000-memory.dmp
memory/952-24-0x0000000000FB0000-0x00000000012FA000-memory.dmp
memory/952-21-0x00000000006C0000-0x00000000006FF000-memory.dmp
memory/952-20-0x00000000006C0000-0x00000000006FF000-memory.dmp
memory/1060-37-0x00000207328B0000-0x00000207329A2000-memory.dmp
memory/3452-19-0x000000000C330000-0x000000000DF9D000-memory.dmp
memory/3452-38-0x0000000006E20000-0x0000000006F04000-memory.dmp
memory/3452-30-0x0000000006E20000-0x0000000006F04000-memory.dmp
memory/3452-29-0x0000000006E20000-0x0000000006F04000-memory.dmp
memory/3452-27-0x000000000C330000-0x000000000DF9D000-memory.dmp
memory/4380-8-0x00000000062B0000-0x00000000062C0000-memory.dmp
memory/4380-9-0x00000000069D0000-0x0000000006A84000-memory.dmp
memory/4380-1-0x00000000002D0000-0x00000000003E2000-memory.dmp
memory/4380-2-0x00000000052D0000-0x0000000005874000-memory.dmp
memory/4380-3-0x0000000004DC0000-0x0000000004E52000-memory.dmp
memory/4380-4-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4380-13-0x0000000075150000-0x0000000075900000-memory.dmp
memory/4380-5-0x0000000075150000-0x0000000075900000-memory.dmp
memory/4380-6-0x0000000005030000-0x00000000050CC000-memory.dmp
memory/4380-7-0x0000000006290000-0x00000000062AA000-memory.dmp
memory/4380-0-0x000000007515E000-0x000000007515F000-memory.dmp
memory/5048-17-0x0000000000400000-0x0000000000443000-memory.dmp
memory/5048-23-0x00000000011B0000-0x00000000011D1000-memory.dmp
memory/5048-22-0x0000000000400000-0x0000000000443000-memory.dmp
memory/5048-10-0x0000000000400000-0x0000000000443000-memory.dmp
memory/5048-12-0x0000000000400000-0x0000000000443000-memory.dmp
memory/5048-14-0x0000000001210000-0x000000000155A000-memory.dmp
memory/5048-18-0x00000000011B0000-0x00000000011D1000-memory.dmp
memory/5048-16-0x0000000000400000-0x0000000000443000-memory.dmp
memory/5048-15-0x0000000000400000-0x0000000000443000-memory.dmp