Analysis
- max time kernel
22s - max time network
22s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
11/09/2024, 16:22
General
- Target Tumiyuvad.exe
- Size 7.3MB
- Sample240911-tvmwna1brf
- SHA256 646b05913cc7364f3bb989f05d35b781838fa493c850ae773d13c22d45952a4a
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tumiyuvad.exe"C:\Users\Admin\AppData\Local\Temp\Tumiyuvad.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evb9D1A.tmp
evbA0F8.tmp
evbC6C5.tmp
memory/2980-0-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-1-0x00007FFF6280D000-0x00007FFF6280E000-memory.dmp
memory/2980-2-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-3-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-5-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-4-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-6-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-7-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-9-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-11-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-12-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-13-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-15-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-16-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-17-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-14-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-10-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-8-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-18-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-19-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-24-0x0000000004F70000-0x0000000004FB6000-memory.dmp
memory/2980-26-0x0000000004EA0000-0x0000000004EC2000-memory.dmp
memory/2980-25-0x0000000004E50000-0x0000000004E6A000-memory.dmp
memory/2980-27-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-28-0x0000000006300000-0x00000000063D0000-memory.dmp
memory/2980-33-0x0000000025670000-0x00000000256BA000-memory.dmp
memory/2980-38-0x0000000020580000-0x00000000205A0000-memory.dmp
memory/2980-43-0x00000000205A0000-0x00000000205BE000-memory.dmp
memory/2980-48-0x0000000025620000-0x000000002563C000-memory.dmp
memory/2980-53-0x0000000025720000-0x000000002577A000-memory.dmp
memory/2980-58-0x00000000257B0000-0x00000000257D6000-memory.dmp
memory/2980-63-0x0000000025780000-0x000000002579E000-memory.dmp
memory/2980-72-0x0000000025650000-0x0000000025658000-memory.dmp
memory/2980-78-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2980-83-0x000000002B970000-0x000000002B97C000-memory.dmp
memory/2980-75-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2980-85-0x00007FFF6280D000-0x00007FFF6280E000-memory.dmp
memory/2980-84-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-86-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-89-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-87-0x00000000005A0000-0x00000000018EE000-memory.dmp
memory/2980-90-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-88-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2980-91-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-92-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-93-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-94-0x00007FFF62770000-0x00007FFF62965000-memory.dmp
memory/2980-99-0x000000002E630000-0x000000002E6E0000-memory.dmp
memory/2980-104-0x000000002E6E0000-0x000000002E756000-memory.dmp
memory/2980-105-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2980-106-0x00000000005A0000-0x00000000018EE000-memory.dmp