Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-07-2024 17:34

General

  • Target

    Client.exe

  • Size

    75KB

  • MD5

    09c9622152c429fbe318c953c0c3e009

  • SHA1

    59735fa6d8ad54afc7397aa412db843a781a50f6

  • SHA256

    3d9236f6298851af038f019993f2234a5b2d543cead447e8e21ce943919cac2f

  • SHA512

    aea506277293522a8bcd1e6e811438f293b1f8cb0da49cb5d0f41e37a31f33426296f5c60698f52f4f35578359c2ac85279fd61e9f54f6448cb85e488990871d

  • SSDEEP

    1536:M0+xfez0ENV8nUw5rASb2LimfcHUtpqKmY7:M0AeQEjboASb2mqz2z

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4660
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2bc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4240

Network

  • flag-us
    DNS
    yahoo-admin.gl.at.ply.gg
    Client.exe
    Remote address:
    8.8.8.8:53
    Request
    yahoo-admin.gl.at.ply.gg
    IN A
    Response
    yahoo-admin.gl.at.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.221.185.147.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    20.221.185.147.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.16.208.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • 147.185.221.20:62850
    yahoo-admin.gl.at.ply.gg
    Client.exe
    156 B
    3
  • 147.185.221.20:62850
    yahoo-admin.gl.at.ply.gg
    Client.exe
    156 B
    3
  • 147.185.221.20:60502
    yahoo-admin.gl.at.ply.gg
    Client.exe
    33.9kB
    1.6MB
    706
    1264
  • 147.185.221.20:60502
    yahoo-admin.gl.at.ply.gg
    Client.exe
    4.9kB
    220.5kB
    100
    183
  • 147.185.221.20:60502
    yahoo-admin.gl.at.ply.gg
    Client.exe
    7.5kB
    84.4kB
    114
    138
  • 147.185.221.20:60502
    yahoo-admin.gl.at.ply.gg
    Client.exe
    594 B
    521 B
    9
    8
  • 147.185.221.20:60502
    yahoo-admin.gl.at.ply.gg
    Client.exe
    560 B
    132 B
    6
    3
  • 8.8.8.8:53
    yahoo-admin.gl.at.ply.gg
    dns
    Client.exe
    70 B
    86 B
    1
    1

    DNS Request

    yahoo-admin.gl.at.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.221.185.147.in-addr.arpa
    dns
    73 B
    130 B
    1
    1

    DNS Request

    20.221.185.147.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    88.16.208.104.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    88.16.208.104.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4660-0-0x00007FF931353000-0x00007FF931354000-memory.dmp

    Filesize

    4KB

  • memory/4660-1-0x000002623A3E0000-0x000002623A3F8000-memory.dmp

    Filesize

    96KB

  • memory/4660-2-0x00007FF931350000-0x00007FF931D3C000-memory.dmp

    Filesize

    9.9MB

  • memory/4660-3-0x00007FF931350000-0x00007FF931D3C000-memory.dmp

    Filesize

    9.9MB

  • memory/4660-4-0x00007FF931353000-0x00007FF931354000-memory.dmp

    Filesize

    4KB

  • memory/4660-5-0x00007FF931350000-0x00007FF931D3C000-memory.dmp

    Filesize

    9.9MB

  • memory/4660-6-0x00007FF931350000-0x00007FF931D3C000-memory.dmp

    Filesize

    9.9MB

  • memory/4660-8-0x0000026254C70000-0x0000026254E28000-memory.dmp

    Filesize

    1.7MB

  • memory/4660-7-0x0000026254BF0000-0x0000026254C66000-memory.dmp

    Filesize

    472KB

  • memory/4660-9-0x000002623C220000-0x000002623C23E000-memory.dmp

    Filesize

    120KB

  • memory/4660-15-0x0000026254FD0000-0x0000026254FE0000-memory.dmp

    Filesize

    64KB

  • memory/4660-16-0x0000026256180000-0x00000262561A2000-memory.dmp

    Filesize

    136KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.