8ad09ce2a389e0d6bf1b5688dfa82f3d38e1c12ac5421ef1ea2999a08dd6dea4

Analysis

max time kernel
16s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

olduimatrix.exe
Size

1.7MB
MD5

980ddfdcc239b7ed4a525d08b62dea6c
SHA1

3d15cc4ba25c88be7bd253d757349899f39dd5de
SHA256

a9de575eff02f40d45172637b59cfb3f82e3a90c7ee6ef655b2b7034659a2821
SHA512

24222b4b06094f7fc1e507a8c1d3e7f6114068985db851dfdad9c01f5cad0982433135d3cd29d1dc6ab8ca7ef497204bb5799719efdfe67602e33e9925cd9e4d
SSDEEP

24576:0vpa5VbRIsWORo24qSpIifm3tLy4s4sb3c9Ho3FfbOKYJja3z:pzKKEpIbGzb3R1fbYJjk

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	olduimatrix.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2524	olduimatrix.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	olduimatrix.exe
2524	olduimatrix.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	olduimatrix.exe
Token: SeDebugPrivilege	2524	olduimatrix.exe
Token: SeLoadDriverPrivilege	2524	olduimatrix.exe
Token: SeShutdownPrivilege	1212	Process not Found

C:\Users\Admin\AppData\Local\Temp\olduimatrix.exe
"C:\Users\Admin\AppData\Local\Temp\olduimatrix.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x000000013FDD0000-0x000000013FF85000-memory.dmp

Filesize
1.7MB

Download
memory/2524-4-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-13-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-11-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-7-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-20-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-15-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-27-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2524-32-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-34-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-50-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-49-0x000000013FDD0000-0x000000013FF85000-memory.dmp

Filesize
1.7MB

Download
memory/2524-47-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-36-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-23-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2524-21-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-17-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-9-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download
memory/2524-51-0x0000000003390000-0x0000000003F0E000-memory.dmp

Filesize
11.5MB

Download