Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
28/06/2024, 01:51
General
- Target d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe
- Size 655KB
- Sample240628-b9vwpsvcmd
- SHA256 d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe"C:\Users\Admin\AppData\Local\Temp\d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Ammet=Get-Content 'C:\Users\Admin\AppData\Roaming\Odontiasis\Goatishness\Bygningsbestanddels\Kork.Eks';$hesperidate=$Ammet.SubString(3360,3);.$hesperidate($Ammet)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Solosanges" /t REG_EXPAND_SZ /d "%Xenoglossia154% -windowstyle minimized $prelocalizations=(Get-ItemProperty -Path 'HKCU:\Vivans\').rearrangeret;%Xenoglossia154% ($prelocalizations)"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Solosanges" /t REG_EXPAND_SZ /d "%Xenoglossia154% -windowstyle minimized $prelocalizations=(Get-ItemProperty -Path 'HKCU:\Vivans\').rearrangeret;%Xenoglossia154% ($prelocalizations)"4⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xs0olf0y.5o3.ps1
AdvSplash.dll
BgImage.dll
UserInfo.dll
nsExec.dll
Kork.Eks
Pitilessness.Lge211
slukningen.lnk
memory/2468-168-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/2468-150-0x0000000003320000-0x0000000003356000-memory.dmp
memory/2468-154-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/2468-155-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/2468-156-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/2468-157-0x0000000006340000-0x0000000006694000-memory.dmp
memory/2468-152-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-167-0x0000000006940000-0x000000000695E000-memory.dmp
memory/2468-151-0x0000000005BC0000-0x00000000061E8000-memory.dmp
memory/2468-170-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/2468-169-0x0000000007910000-0x00000000079A6000-memory.dmp
memory/2468-171-0x0000000006EB0000-0x0000000006ED2000-memory.dmp
memory/2468-172-0x0000000007F60000-0x0000000008504000-memory.dmp
memory/2468-153-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-174-0x0000000008B90000-0x000000000920A000-memory.dmp
memory/2468-176-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-177-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-149-0x000000007419E000-0x000000007419F000-memory.dmp
memory/2468-179-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-180-0x0000000009210000-0x000000000D01D000-memory.dmp
memory/2468-181-0x000000007419E000-0x000000007419F000-memory.dmp
memory/2468-182-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-184-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-185-0x0000000026730000-0x0000000027984000-memory.dmp
memory/2468-186-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-189-0x0000000074190000-0x0000000074940000-memory.dmp
memory/2468-190-0x0000000074190000-0x0000000074940000-memory.dmp