Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/06/2024, 08:27
General
- Target plutonium.exe
- Size 4.6MB
- Sample240614-kcwamssdqa
- SHA256 85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f
Malware Config
Signatures
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
plutonium.exe.log
memory/4012-34-0x00000226BF970000-0x00000226BF9A2000-memory.dmp
memory/4676-16-0x000001664C2F0000-0x000001664C372000-memory.dmp
memory/4676-19-0x000001664C670000-0x000001664C696000-memory.dmp
memory/4676-4-0x0000016631160000-0x000001663116C000-memory.dmp
memory/4676-5-0x000001664B250000-0x000001664B26A000-memory.dmp
memory/4676-6-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-7-0x0000016632950000-0x000001663295A000-memory.dmp
memory/4676-8-0x000001664B270000-0x000001664B27A000-memory.dmp
memory/4676-9-0x000001664B410000-0x000001664B77C000-memory.dmp
memory/4676-18-0x000001664B990000-0x000001664B9C2000-memory.dmp
memory/4676-11-0x000001664B8F0000-0x000001664B8F8000-memory.dmp
memory/4676-12-0x000001664B9C0000-0x000001664BA7A000-memory.dmp
memory/4676-13-0x000001664BA80000-0x000001664C2E6000-memory.dmp
memory/4676-14-0x000001664B900000-0x000001664B950000-memory.dmp
memory/4676-15-0x000001664B950000-0x000001664B972000-memory.dmp
memory/4676-3-0x0000016632970000-0x0000016632978000-memory.dmp
memory/4676-0-0x00007FFFF3A33000-0x00007FFFF3A35000-memory.dmp
memory/4676-10-0x000001664B8B0000-0x000001664B8F2000-memory.dmp
memory/4676-17-0x000001664C4B0000-0x000001664C526000-memory.dmp
memory/4676-20-0x000001664C6B0000-0x000001664C6B8000-memory.dmp
memory/4676-21-0x000001664CC50000-0x000001664CC66000-memory.dmp
memory/4676-22-0x000001664CC70000-0x000001664CC7A000-memory.dmp
memory/4676-23-0x000001664E940000-0x000001664E968000-memory.dmp
memory/4676-24-0x00007FFFF3A33000-0x00007FFFF3A35000-memory.dmp
memory/4676-25-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-26-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-27-0x00000166514F0000-0x0000016651528000-memory.dmp
memory/4676-28-0x0000016650DD0000-0x0000016650DDE000-memory.dmp
memory/4676-29-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-30-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-32-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp
memory/4676-2-0x000001664B1D0000-0x000001664B250000-memory.dmp
memory/4676-1-0x0000016630900000-0x0000016630DA8000-memory.dmp