Analysis

  • max time kernel
    145s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 02:02

General

  • Target

    b39fc50bee5a51c5a143e799c7676af63cb06ab92e07f9e90a37ac12fc534b3e.exe

  • Size

    327KB

  • MD5

    22d35cdedb4d4109510b9394610f5b2e

  • SHA1

    5bc5e5856e4b2317966eff4dade064242db0948a

  • SHA256

    b39fc50bee5a51c5a143e799c7676af63cb06ab92e07f9e90a37ac12fc534b3e

  • SHA512

    9488d53bfb361cfbddb069ee59af2f14a3134a7cf585b318e2511df7eebaac8cd915a00b0457a9b16a96b4c289b41673bbfae87827749173b5e0bd359638ef2a

  • SSDEEP

    6144:iJjREwLniAOzZx8pzwInnnpfnLItus2al85/Fj9QLMzhfOeQSK/04KSI:MmonhOzZx8pPnpTIKu0dj9yMzhfDdK8

Score
10/10

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Mimikatz family
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:676
  • C:\Windows\sysmon.exe
    C:\Windows\sysmon.exe
    1⤵
      PID:2716
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3540
        • C:\Users\Admin\AppData\Local\Temp\b39fc50bee5a51c5a143e799c7676af63cb06ab92e07f9e90a37ac12fc534b3e.exe
          "C:\Users\Admin\AppData\Local\Temp\b39fc50bee5a51c5a143e799c7676af63cb06ab92e07f9e90a37ac12fc534b3e.exe"
          2⤵
            PID:3260
            • C:\Windows\System32\werfault.exe
              \??\C:\Windows\System32\werfault.exe
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1056
              • C:\Windows\system32\rundll32.exe
                C:\Windows\system32\rundll32.exe
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3820
                • C:\Windows\system32\ipconfig.exe
                  "C:\Windows\system32\ipconfig.exe" /all
                  5⤵
                  • Gathers network information
                  PID:2232
              • C:\Windows\system32\rundll32.exe
                C:\Windows\system32\rundll32.exe
                4⤵
                  PID:2652
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /C set
                  4⤵
                    PID:2128
                  • C:\Windows\system32\rundll32.exe
                    C:\Windows\system32\rundll32.exe
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:872
                  • C:\Windows\system32\rundll32.exe
                    C:\Windows\system32\rundll32.exe
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3184
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              1⤵
                PID:3212
              • C:\Windows\system32\BackgroundTransferHost.exe
                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                1⤵
                  PID:2992

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/676-39-0x0000027193740000-0x0000027193741000-memory.dmp

                  Filesize

                  4KB

                • memory/872-33-0x00000210C0CA0000-0x00000210C0CED000-memory.dmp

                  Filesize

                  308KB

                • memory/1056-6-0x00000142DB790000-0x00000142DB7E8000-memory.dmp

                  Filesize

                  352KB

                • memory/1056-2-0x00000142DB480000-0x00000142DB4CC000-memory.dmp

                  Filesize

                  304KB

                • memory/1056-3-0x00000142DB790000-0x00000142DB7E8000-memory.dmp

                  Filesize

                  352KB

                • memory/2652-24-0x0000022694390000-0x00000226943B6000-memory.dmp

                  Filesize

                  152KB

                • memory/2652-25-0x00007FFF74DC5000-0x00007FFF74DC6000-memory.dmp

                  Filesize

                  4KB

                • memory/2652-45-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-44-0x0000022694390000-0x00000226943B6000-memory.dmp

                  Filesize

                  152KB

                • memory/2652-32-0x0000022694390000-0x00000226943B6000-memory.dmp

                  Filesize

                  152KB

                • memory/2652-31-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-30-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-29-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-27-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-26-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2652-22-0x00000226940C0000-0x00000226940E2000-memory.dmp

                  Filesize

                  136KB

                • memory/2652-23-0x0000022694390000-0x00000226943B6000-memory.dmp

                  Filesize

                  152KB

                • memory/3184-36-0x000002B51A990000-0x000002B51A9A5000-memory.dmp

                  Filesize

                  84KB

                • memory/3260-4-0x00007FF6B4CB0000-0x00007FF6B4E50000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3260-0-0x00007FF6B4CB0000-0x00007FF6B4E50000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3260-1-0x00007FFF95030000-0x00007FFF95225000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3540-53-0x0000000007630000-0x0000000007649000-memory.dmp

                  Filesize

                  100KB

                • memory/3540-52-0x0000000007610000-0x0000000007625000-memory.dmp

                  Filesize

                  84KB

                • memory/3820-12-0x00000134C8460000-0x00000134C8482000-memory.dmp

                  Filesize

                  136KB

                • memory/3820-15-0x00007FFF74DC5000-0x00007FFF74DC6000-memory.dmp

                  Filesize

                  4KB

                • memory/3820-17-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-16-0x00000134C8B70000-0x00000134C8B78000-memory.dmp

                  Filesize

                  32KB

                • memory/3820-19-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-34-0x00007FFF74DC5000-0x00007FFF74DC6000-memory.dmp

                  Filesize

                  4KB

                • memory/3820-35-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-18-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-38-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-28-0x00000134C8700000-0x00000134C8726000-memory.dmp

                  Filesize

                  152KB

                • memory/3820-14-0x00000134C8700000-0x00000134C8726000-memory.dmp

                  Filesize

                  152KB

                • memory/3820-13-0x00000134C8700000-0x00000134C8726000-memory.dmp

                  Filesize

                  152KB

                • memory/3820-20-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB

                • memory/3820-21-0x00007FFF74B10000-0x00007FFF754B1000-memory.dmp

                  Filesize

                  9.6MB