Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
27-06-2024 18:29
General
-
Target
0982cad1794aba43938a7db57eaa47fdf491baf804a2709ae8713eee4cffdb1c.exe
-
Size
6.3MB
-
MD5
784114f9b669956a77a1fca0c7991dcf
-
SHA1
ff7fce437c74d352d910b02911f62d53783249b4
-
SHA256
0982cad1794aba43938a7db57eaa47fdf491baf804a2709ae8713eee4cffdb1c
-
SHA512
1cb4afe1e5f9f56ced0a8ecbb18c50a6842449ea8751c73a7baf3e5d2d84b0f9c8f4505ebd255762f1d26e6b521102d758c2419f702ec9a7d6329d0b053cfafa
-
SSDEEP
196608:XMfLdxcMZ+L8o9cc5a9MwGf4Cmlbjf3L12g2Do+:opxl+nec5aqw04CCbjfxZH+
Score
10/10
Malware Config
Signatures
-
Detected Ploutus loader 47 IoCs
-
Ploutus
Ploutus is an ATM malware written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0982cad1794aba43938a7db57eaa47fdf491baf804a2709ae8713eee4cffdb1c.exe"C:\Users\Admin\AppData\Local\Temp\0982cad1794aba43938a7db57eaa47fdf491baf804a2709ae8713eee4cffdb1c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-0-0x00000000741DE000-0x00000000741DF000-memory.dmpFilesize
4KB
-
memory/1768-1-0x0000000006D10000-0x0000000007876000-memory.dmpFilesize
11.4MB
-
memory/1768-2-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/1768-3-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/1768-4-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/1768-5-0x00000000061A0000-0x0000000006D04000-memory.dmpFilesize
11.4MB
-
memory/1768-6-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-10-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-11-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-13-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-17-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-19-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-7-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-102-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-21-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-23-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-25-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-44-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-48-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-51-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-54-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-58-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-61-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-63-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-67-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-69-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-72-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-74-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-77-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-15-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-80-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-83-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-87-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-89-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-93-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-97-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-99-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-107-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-110-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-113-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-117-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-120-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-27-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-29-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-31-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-33-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-35-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-46-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-41-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-39-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-37-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-50-0x00000000061A0000-0x0000000006CFF000-memory.dmpFilesize
11.4MB
-
memory/1768-48136-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/1768-48137-0x00000000741DE000-0x00000000741DF000-memory.dmpFilesize
4KB
-
memory/1768-48138-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/1768-48139-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB