Resubmissions

23/08/2024, 16:00

240823-tf47dsteqe 6

23/08/2024, 15:32

240823-sy293sseld 4

23/08/2024, 15:18

240823-sp1d5athqk 8

23/08/2024, 14:12

240823-rjcv7sydnd 7

23/08/2024, 02:33

240823-c17dta1cpd 7

23/08/2024, 02:11

240823-cmbpzszelg 4

23/08/2024, 02:00

240823-ce59mazbnh 4

23/08/2024, 01:37

240823-b1992a1dmm 5

23/08/2024, 01:24

240823-bsm5jazhpp 5

23/08/2024, 00:51

240823-a7p21awhld 6

Analysis

  • max time kernel
    140s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 01:37

General

  • Target

    dcomcnfg.exe

  • Size

    28KB

  • MD5

    dfa0d5bcde97e541aae197b791b0bf77

  • SHA1

    602883cd4308964a2e0fc74a561861908400144f

  • SHA256

    893a6c696459fe6f44c5e71dba1f792df37ba765095548d125ba43aca4f47b18

  • SHA512

    bf78cf1c20941f4735549c427a8295b7b2ea5756d1246b7530c0e1e55a9c1f28574d93a0de4faf2392df07940f2733208451130718150357efc390a09b75087c

  • SSDEEP

    192:XJTPYfus5uLG27WxL3uX8E4+7L5Eyf9CseWEFCpt2cjIfWJfsW0EW:ZTAWsYcL3fEP7LGj7FCp6fWyW0EW

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe
    "C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
      2⤵
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4488
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Drops file in Windows directory
    PID:3512
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4488-0-0x00007FFB50153000-0x00007FFB50155000-memory.dmp

    Filesize

    8KB

  • memory/4488-1-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-2-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-3-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-4-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-5-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-6-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-7-0x00007FFB50153000-0x00007FFB50155000-memory.dmp

    Filesize

    8KB

  • memory/4488-8-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-9-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB

  • memory/4488-10-0x00007FFB50150000-0x00007FFB50C11000-memory.dmp

    Filesize

    10.8MB