Analysis
- max time kernel
139s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
16/07/2024, 16:58
General
- Target se.exe
- Size 148KB
- Sample240716-vg3kmasalk
- SHA256 0822d4c51c466544072ac07dd5c2dbf4143431fb6955a05911600fed50d0229a
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\se.exe"C:\Users\Admin\AppData\Local\Temp\se.exe"1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_73f0f0df.exe"C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_73f0f0df.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
confrontation_73f0f0df.exe
memory/2388-0-0x000001919C630000-0x000001919C64B000-memory.dmp
memory/2388-1-0x000001919C650000-0x000001919C664000-memory.dmp
memory/2388-7-0x000001919C650000-0x000001919C664000-memory.dmp
memory/2388-6-0x00007FF627350000-0x00007FF627379000-memory.dmp
memory/3372-8-0x0000026239190000-0x00000262391A4000-memory.dmp