Analysis

  • max time kernel
    226s
  • max time network
    236s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 19:06

General

  • Target

    MetaBuilder/localhost.exe

  • Size

    15KB

  • MD5

    370da482fb58f93035d09077248b9b5c

  • SHA1

    7ae2de3498675051b4510080fe0a6bc35ff994d7

  • SHA256

    0e74f8d729d60528def2b52cb20e45b60828d816dadfc6c3b2ec672e346ba659

  • SHA512

    8d41e28eef203b416ebeba8d8f6e2d5de32eac32ec40f5e9a0f43d82e919b5fd6a57a386058c4feaa65adba10e12de1fd7a7a80da430f51183c6a2ede927baa5

  • SSDEEP

    192:e57hld1ooEEt6dmi/yXYO9ghZcuyK+slH9gN8wYLgCQqF+h:g7LgREt6dmyyZ9ghCnKrH9DzLvQB

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MetaBuilder\localhost.exe
    "C:\Users\Admin\AppData\Local\Temp\MetaBuilder\localhost.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c timeout /t 1 && DEL /f localhost.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\system32\timeout.exe
        timeout /t 1
        3⤵
        • Delays execution with timeout.exe
        PID:3300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1436-0-0x00007FF9FFBA3000-0x00007FF9FFBA5000-memory.dmp

    Filesize

    8KB

  • memory/1436-1-0x0000018215BA0000-0x0000018215BAA000-memory.dmp

    Filesize

    40KB

  • memory/1436-3-0x00007FF9FFBA0000-0x00007FFA00661000-memory.dmp

    Filesize

    10.8MB

  • memory/1436-4-0x00007FF9FFBA0000-0x00007FFA00661000-memory.dmp

    Filesize

    10.8MB