Analysis
- max time kernel
94s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/11/2024, 01:25
General
- Target 82ce6bee57e0fff6d1e0791b7b75cb4d6714ba8a3f7d10e4fa040fac637df7a9.exe
- Size 1.3MB
- Sample241114-btgdda1rb1
- SHA256 82ce6bee57e0fff6d1e0791b7b75cb4d6714ba8a3f7d10e4fa040fac637df7a9
Malware Config
Signatures
- Deletes itself 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ce6bee57e0fff6d1e0791b7b75cb4d6714ba8a3f7d10e4fa040fac637df7a9.exe"C:\Users\Admin\AppData\Local\Temp\82ce6bee57e0fff6d1e0791b7b75cb4d6714ba8a3f7d10e4fa040fac637df7a9.exe"1⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell -ExecutionPolicy Bypass -File C:\kill.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -File C:\kill.ps13⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ala3qivu.qkw.ps1
kill.ps1
memory/1392-37-0x0000000005660000-0x00000000059B4000-memory.dmp
memory/1392-24-0x0000000004C60000-0x0000000005288000-memory.dmp
memory/1392-48-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/1392-45-0x0000000008010000-0x000000000868A000-memory.dmp
memory/1392-44-0x00000000073E0000-0x0000000007984000-memory.dmp
memory/1392-43-0x00000000060E0000-0x0000000006102000-memory.dmp
memory/1392-42-0x0000000006080000-0x000000000609A000-memory.dmp
memory/1392-41-0x0000000006D20000-0x0000000006DB6000-memory.dmp
memory/1392-23-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/1392-39-0x0000000005BA0000-0x0000000005BEC000-memory.dmp
memory/1392-38-0x0000000005B50000-0x0000000005B6E000-memory.dmp
memory/1392-27-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/1392-26-0x0000000005480000-0x00000000054E6000-memory.dmp
memory/1392-20-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/1392-25-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/1392-21-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/1392-22-0x0000000002260000-0x0000000002296000-memory.dmp
memory/5032-1-0x0000000010000000-0x0000000010018000-memory.dmp
memory/5032-10-0x0000000010000000-0x0000000010018000-memory.dmp
memory/5032-19-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/5032-18-0x0000000010000000-0x0000000010018000-memory.dmp
memory/5032-2-0x0000000036CE0000-0x0000000036CF0000-memory.dmp
memory/5032-12-0x0000000000400000-0x000000000058C000-memory.dmp
memory/5032-3-0x0000000076CF0000-0x0000000076CF1000-memory.dmp
memory/5032-17-0x0000000000400000-0x000000000058C000-memory.dmp
memory/5032-0-0x0000000010000000-0x0000000010018000-memory.dmp
memory/5032-11-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/5032-13-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/5032-5-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/5032-7-0x0000000002440000-0x00000000024C0000-memory.dmp
memory/5032-6-0x0000000076CD0000-0x0000000076DC0000-memory.dmp
memory/5032-4-0x0000000002440000-0x00000000024C0000-memory.dmp