7b9a0fd990959dfd15a879bbffd13d4959b9bdeecf6831b91b8ac02d72e9bba5

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spoof Instructions/Toolz/DNSBench.exe
Size

168KB
MD5

04177f89fa23b9d6fec146d9be737566
SHA1

b95ea3c6094affda5f05110d1c0ae6daa56ebc2b
SHA256

a1375a7ecbacf70efd3d54c7ec3c1ceae7166ad1c723b390ac78d7a3e1b19f92
SHA512

75244f24c1d3710e7eb292d72fce0e276143f6302d02edf22db484be21cda52f74166fff3e511a734de1b1b77c18d0ddf9776586d8e102d5f9619d7011c1f3ad
SSDEEP

3072:5Sww+ICvU0Qv8Z9yzvSh3gzaDKzHDa4cn2qTWM9gbYfOheIB2:5SwwPC08CzvSh3geOzm4cn2AWM9gbi

Score

7^/10

discovery

Malware Config

Signatures

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.220.222
Destination IP	129.250.35.250
Destination IP	4.2.2.4
Destination IP	68.4.16.25
Destination IP	198.153.192.1
Destination IP	208.67.222.222
Destination IP	68.111.16.30
Destination IP	68.12.16.30
Destination IP	156.154.70.22
Destination IP	66.92.224.2
Destination IP	68.87.69.154
Destination IP	64.81.111.2
Destination IP	198.41.0.4
Destination IP	4.2.2.6
Destination IP	68.11.16.25
Destination IP	68.100.16.30
Destination IP	208.67.220.220
Destination IP	209.55.1.220
Destination IP	4.2.2.5
Destination IP	66.92.159.2
Destination IP	68.2.16.25
Destination IP	74.118.212.2
Destination IP	156.154.71.25
Destination IP	24.113.32.29
Destination IP	68.87.64.154
Destination IP	156.154.70.1
Destination IP	68.13.16.30
Destination IP	216.231.41.2
Destination IP	156.154.71.22
Destination IP	68.9.16.30
Destination IP	129.250.35.251
Destination IP	156.154.70.25
Destination IP	68.6.16.30
Destination IP	68.1.18.30
Destination IP	68.4.16.30
Destination IP	64.81.79.2
Destination IP	208.67.220.123
Destination IP	24.113.32.30
Destination IP	68.10.16.25
Destination IP	68.10.16.30
Destination IP	216.27.175.2
Destination IP	1.0.0.1
Destination IP	68.9.16.25
Destination IP	204.97.212.10
Destination IP	68.12.16.25
Destination IP	204.194.234.200
Destination IP	64.81.127.2
Destination IP	68.100.16.25
Destination IP	74.118.212.1
Destination IP	198.153.194.1
Destination IP	68.6.16.25
Destination IP	208.67.222.123
Destination IP	68.111.16.25
Destination IP	4.2.2.3
Destination IP	64.81.45.2
Destination IP	68.1.18.25
Destination IP	68.2.16.30
Destination IP	68.11.16.30
Destination IP	68.13.16.25
Destination IP	156.154.71.1
Destination IP	64.81.159.2
Destination IP	66.92.64.2
Destination IP	4.2.2.2
Destination IP	209.55.0.110

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNSBench.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4168	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4168	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Spoof Instructions\Toolz\DNSBench.exe
"C:\Users\Admin\AppData\Local\Temp\Spoof Instructions\Toolz\DNSBench.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x314 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3196-7-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-8-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-9-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3196-10-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-11-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-12-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-13-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3196-14-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download