Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
27/08/2024, 04:29
General
- Target $APPDATA/simpleLogin/ear/resToResX.exe
- Size 38KB
- Sample240827-e4bsesvcpn
- SHA256 3a530aacf477d005147c3b3a782b96a7c9a8a17a0a3e163be255ca8a133ea430
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$APPDATA\simpleLogin\ear\resToResX.exe"C:\Users\Admin\AppData\Local\Temp\$APPDATA\simpleLogin\ear\resToResX.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2540-0-0x00007FF948015000-0x00007FF948016000-memory.dmp
memory/2540-1-0x00007FF947D60000-0x00007FF948701000-memory.dmp
memory/2540-2-0x00007FF947D60000-0x00007FF948701000-memory.dmp
memory/2540-6-0x00007FF947D60000-0x00007FF948701000-memory.dmp