Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
06-10-2024 06:09
General
-
Target
Sorillus-Launcher v1.1.exe
-
Size
1.2MB
-
MD5
85cecea8cd99baa57decdeddd6c7f800
-
SHA1
43af40ab8eb41cb02fed8d223c5098e2fb15c2d8
-
SHA256
43d005cf6b3c5883e6a5bca5aa4863ad46477b0b79f68dc0a907dd8cfaf280e2
-
SHA512
d104dae2510cbe79a2b7a21e7156d80ed2a131ef701204590f8e739145ffa8c9cf1985c9f1360816788e62ff378ef3b7c80c7badec66e65fd30364f0ee0f633a
-
SSDEEP
24576:vPZl0enBpHMy5zUdw4GRqemkilngx69BVx2YqXId228r9AtyeeSyj:wSGy5zOw4hVh10W4Y+r9Aty/
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Djavafx.animation.fullspeed=true -jar "C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v1.1.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5b0366e31f3704da1e9552633a07f77db
SHA1fd3058cc08a5e00b56301dc44e0e05854a5e55ea
SHA25618f1f5afec89f152afe1c57cffe9a77c158d840f6e00ec7a343b685caa3d8853
SHA512d8e621eb9b15103a70544affbd7e3fdf52fe14bdae754fd9551508ed8785d53b6205082de41a575acffe5d1c80d419eda16d79834fdbad9cc8df798dcaa4eaa4
-
Filesize
256KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB