Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
11/07/2024, 02:00
General
-
Target
amtemu.v0.9.1-painter.exe
-
Size
2.4MB
-
MD5
a209b88b9b2cf7339be0ac5126417875
-
SHA1
16cccef91ee368f9e4bbf09c5eab30865b380150
-
SHA256
c2f6d462a20f92b97c49c3af19872fc4df6aabd4f66f4b8b298a1303881422f6
-
SHA512
dae048524cb11db9120f4e62f0e452833e15af91738d30289f2a9a875f042fd626a7c1295f13519cc7c59ac6b6c9dcd6ef8385cace84f7109ce23cf69efc83c5
-
SSDEEP
49152:4keFZ2jcLaZBHiMT0uR5Y+BdxyHSSzZLMZ:4kTZBCHuvFkGZ
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.1-painter.exe"C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.1-painter.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x3f41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD541afbf49ba7f6ee164f31faa2cd38e15
SHA14a9aeebf6e2a3c459629662b4e3d72fe210da63f
SHA25650d30b7aa7b9858f91f33165314c7cf7f2acc97157091676c7e7925e018fd387
SHA512a323705e7e286f2e1cb821cccf1f24812020ef1b788f51e13176afaa04cb008899a32270bad7757204cbf9fce1a9887071fa84d353af2e5a667cba003c7f1efe
-
Filesize
2.5MB
-
Filesize
1.1MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB