c977ae66e324525a57dd0982d670fce03626aa70b4c57e7aff2ba8eab97e4e75 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 06:57

Sharing

Report Analysis Logs

General

Target

Erebus-master/exp/sp/sp.exe
Size

71KB
MD5

b2a64dc8ac56a13247f7b1beab39b6bc
SHA1

93ac76efc0992889669e0527af28d1a07e1df241
SHA256

41236f7197f79d287226bba44eac778f7fc59d7b56f3fb8ec80d8e64fa9a40d3
SHA512

a0eced5a5bb69f9df7cf0b0605084a7864436e72f6fb84d063d83f1210eccad61cbfe3086201c5a183d2bd30a9b0856f3bb1df6c1b11d849c3ad17c5b651c30c
SSDEEP

1536:JZIehKZJJUcldrA3YQ5LrsGbzexZEs/W+zntWVogK89LOQ7:/IehKHJ/YLNze/WsX89LO6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2408	sp.exe
Token: SeAssignPrimaryTokenPrivilege	2408	sp.exe
Token: SeIncreaseQuotaPrivilege	2408	sp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2944	2408	sp.exe	32
PID 2408 wrote to memory of 2944	2408	sp.exe	32
PID 2408 wrote to memory of 2944	2408	sp.exe	32

C:\Users\Admin\AppData\Local\Temp\Erebus-master\exp\sp\sp.exe
"C:\Users\Admin\AppData\Local\Temp\Erebus-master\exp\sp\sp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- \??\c:\Windows\System32\werfault.exe
  "c:\Windows\System32\werfault.exe"
  2⤵
  PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 788
  2⤵
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x000007FEF5DA3000-0x000007FEF5DA4000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000001380000-0x0000000001398000-memory.dmp

Filesize
96KB

Download
memory/2408-2-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-3-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download