b50bbb4b93fd8ef7a2876b3743dfda6945e9011f406e71b41897244b0b836467

Analysis

max time kernel
115s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10-08-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe
Size

1.7MB
MD5

2602189f4866124a6c0fd1d96b469294
SHA1

7b8d4281f21fb812b59bd81b363ca5e77085632d
SHA256

06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40
SHA512

b0c7ea3dd733495f1f7295277abefdb24bcc58860256ed598fdbb0464554eced7cfa741b51ef725a26349486a3bc7f954f6fae4f16ea809a1a2bd6c58adcef18
SSDEEP

24576:i1VOinuCZ5XggevDaU74o7IhjY48s20MVc8DijpemisHrFcsIQ/iSpODiTFA:ONg/gjP8N0Scbjrp0Q/LYDiTF

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe
Token: SeDebugPrivilege	4312	06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe
Token: SeDebugPrivilege	2884	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2884	4312	06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe	74
PID 4312 wrote to memory of 2884	4312	06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe	74
PID 4312 wrote to memory of 2884	4312	06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe	74

C:\Users\Admin\AppData\Local\Temp\06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe
"C:\Users\Admin\AppData\Local\Temp\06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-1052-0x000001BE70B40000-0x000001BE70B8B000-memory.dmp

Filesize
300KB

Download
memory/2884-1053-0x00007FFC8AAB3000-0x00007FFC8AAB4000-memory.dmp

Filesize
4KB

Download
memory/2884-1054-0x000001BE726A0000-0x000001BE726E6000-memory.dmp

Filesize
280KB

Download
memory/2884-1055-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/2884-1056-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/2884-1059-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/4312-38-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-30-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-3-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/4312-4-0x00000268AA4E0000-0x00000268AA5FE000-memory.dmp

Filesize
1.1MB

Download
memory/4312-16-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-64-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-68-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-66-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-60-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-58-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-56-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-54-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-52-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-48-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-46-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-62-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-50-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-44-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-42-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-40-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-1-0x00007FFC8AAB3000-0x00007FFC8AAB4000-memory.dmp

Filesize
4KB

Download
memory/4312-36-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-32-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-2-0x00000268AA370000-0x00000268AA48C000-memory.dmp

Filesize
1.1MB

Download
memory/4312-28-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-27-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-24-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-22-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-20-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-18-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-14-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-12-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-11-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-8-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-6-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-5-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-34-0x00000268AA4E0000-0x00000268AA5F8000-memory.dmp

Filesize
1.1MB

Download
memory/4312-1041-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/4312-1042-0x0000026891AF0000-0x0000026891B8E000-memory.dmp

Filesize
632KB

Download
memory/4312-1043-0x00000268AA600000-0x00000268AA64C000-memory.dmp

Filesize
304KB

Download
memory/4312-0-0x000002688FD10000-0x000002688FEC8000-memory.dmp

Filesize
1.7MB

Download
memory/4312-1044-0x00007FFC8AAB3000-0x00007FFC8AAB4000-memory.dmp

Filesize
4KB

Download
memory/4312-1045-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/4312-1047-0x00000268AA850000-0x00000268AA8A4000-memory.dmp

Filesize
336KB

Download
memory/4312-1048-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download
memory/4312-1051-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Filesize
9.9MB

Download