Analysis
- max time kernel
150s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
14/06/2024, 08:27
General
- Target plutonium.exe
- Size 4.6MB
- Sample240614-kcwamssdqa
- SHA256 85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
plutonium.exe.log
memory/1260-37-0x0000027B448E0000-0x0000027B44912000-memory.dmp
memory/1260-36-0x0000027B432A0000-0x0000027B433BF000-memory.dmp
memory/4796-18-0x0000029744100000-0x0000029744132000-memory.dmp
memory/4796-19-0x0000029744DF0000-0x0000029744E16000-memory.dmp
memory/4796-5-0x0000029729940000-0x000002972995A000-memory.dmp
memory/4796-6-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-7-0x00000297298F0000-0x00000297298FA000-memory.dmp
memory/4796-8-0x0000029729910000-0x000002972991A000-memory.dmp
memory/4796-9-0x0000029743BD0000-0x0000029743F3C000-memory.dmp
memory/4796-10-0x0000029744030000-0x0000029744072000-memory.dmp
memory/4796-11-0x0000029729B30000-0x0000029729B38000-memory.dmp
memory/4796-12-0x0000029744130000-0x00000297441EA000-memory.dmp
memory/4796-21-0x0000029746570000-0x0000029746586000-memory.dmp
memory/4796-15-0x00000297440C0000-0x00000297440E2000-memory.dmp
memory/4796-14-0x0000029744070000-0x00000297440C0000-memory.dmp
memory/4796-16-0x0000029744A60000-0x0000029744AE2000-memory.dmp
memory/4796-17-0x0000029744C30000-0x0000029744CA6000-memory.dmp
memory/4796-0-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp
memory/4796-4-0x00000297298B0000-0x00000297298BC000-memory.dmp
memory/4796-20-0x0000029744E30000-0x0000029744E38000-memory.dmp
memory/4796-13-0x00000297441F0000-0x0000029744A56000-memory.dmp
memory/4796-22-0x0000029744E20000-0x0000029744E2A000-memory.dmp
memory/4796-23-0x0000029746700000-0x0000029746728000-memory.dmp
memory/4796-24-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp
memory/4796-25-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-26-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-27-0x00000297493B0000-0x00000297493E8000-memory.dmp
memory/4796-28-0x0000029748C50000-0x0000029748C5E000-memory.dmp
memory/4796-29-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-30-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-31-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-32-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-34-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp
memory/4796-3-0x0000029729900000-0x0000029729908000-memory.dmp
memory/4796-2-0x00000297439B0000-0x0000029743A30000-memory.dmp
memory/4796-1-0x0000029728FF0000-0x0000029729498000-memory.dmp