Analysis
- max time kernel
143s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
18/06/2024, 23:08
General
- Target github.software.1.0.8.exe
- Size 684.0MB
- Sample240618-24vxmashmp
- SHA256 257921a35555d31ad07cb05a838ab1003d94cdf66a12e21e6fcea5559f53280b
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\github.software.1.0.8.exe"C:\Users\Admin\AppData\Local\Temp\github.software.1.0.8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Installer_Expert_Advanced_v9.5\Installer_Expert_Advanced_v9.5.exe"C:\Users\Admin\AppData\Local\Temp\Installer_Expert_Advanced_v9.5\Installer_Expert_Advanced_v9.5.exe" -pO1ANKZyami02⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer_X_v6.8.3.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer_X_v6.8.3.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0qhvdiwu.tci.ps1
memory/3540-60-0x0000000008080000-0x00000000086FA000-memory.dmp
memory/3540-59-0x0000000006B80000-0x0000000006BC6000-memory.dmp
memory/3540-64-0x0000000015800000-0x0000000015822000-memory.dmp
memory/3540-63-0x0000000007CE0000-0x0000000007D8A000-memory.dmp
memory/3540-61-0x0000000007A40000-0x0000000007A5A000-memory.dmp
memory/3540-46-0x00000000057F0000-0x0000000005812000-memory.dmp
memory/3540-58-0x0000000006740000-0x000000000678C000-memory.dmp
memory/3540-57-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/3540-47-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/3540-45-0x00000000058C0000-0x0000000005EEA000-memory.dmp
memory/3540-56-0x00000000061C0000-0x0000000006517000-memory.dmp
memory/3540-44-0x00000000051E0000-0x0000000005216000-memory.dmp
memory/3772-43-0x000000007367E000-0x000000007367F000-memory.dmp
memory/3772-37-0x000000002C7E0000-0x000000002CD86000-memory.dmp
memory/3772-36-0x0000000000F60000-0x0000000001F60000-memory.dmp
memory/3772-42-0x0000000041200000-0x000000004129C000-memory.dmp
memory/3772-41-0x000000002C5C0000-0x000000002C626000-memory.dmp
memory/3772-35-0x000000007367E000-0x000000007367F000-memory.dmp
memory/3772-40-0x000000002C460000-0x000000002C46A000-memory.dmp
memory/3772-62-0x0000000073670000-0x0000000073E21000-memory.dmp
memory/3772-39-0x0000000073670000-0x0000000073E21000-memory.dmp
memory/3772-38-0x000000002C2D0000-0x000000002C362000-memory.dmp
memory/3772-68-0x0000000073670000-0x0000000073E21000-memory.dmp