cdc95d0113a2af05c2e70fab23f6c218ae583ebcb47077dd5b705a476f9d6b96

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amtemu.v0.9.2-painter.exe
Size

2.4MB
MD5

8abdc20f619641e29aa9ad2b999a0dcc
SHA1

caad125358d2ae6d217e74cfcd175ac81c43c729
SHA256

cdc95d0113a2af05c2e70fab23f6c218ae583ebcb47077dd5b705a476f9d6b96
SHA512

90999eb0bcb76a3d21e63565e332f1ac8a6fbc1e3dfe147c4ba2b5f8c542e21da3a43df9f5074eb7f7107e0e66d48e21cedda568fa1960502645f1b358d1550e
SSDEEP

49152:+kLvWlT+7CZ1k+1T0RSkXDE+QO6oP4DQ4E7U+:+kCZ1bad4+QOJgDQI

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1276	amtemu.v0.9.2-painter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amtemu.v0.9.2-painter.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	amtemu.v0.9.2-painter.exe
1276	amtemu.v0.9.2-painter.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4468	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	amtemu.v0.9.2-painter.exe

C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2-painter.exe
"C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2-painter.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\spc_player.dll

Filesize
31KB

MD5
41afbf49ba7f6ee164f31faa2cd38e15

SHA1
4a9aeebf6e2a3c459629662b4e3d72fe210da63f

SHA256
50d30b7aa7b9858f91f33165314c7cf7f2acc97157091676c7e7925e018fd387

SHA512
a323705e7e286f2e1cb821cccf1f24812020ef1b788f51e13176afaa04cb008899a32270bad7757204cbf9fce1a9887071fa84d353af2e5a667cba003c7f1efe

Download Submit
memory/1276-0-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/1276-1-0x0000000000401000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1276-2-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/1276-3-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/1276-4-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/1276-9-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download