Resubmissions

01/04/2025, 21:24

250401-z8184awycs 10

Analysis

  • max time kernel
    598s
  • max time network
    609s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/12/2024, 11:35

General

  • Target

    fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe

  • Size

    19KB

  • MD5

    6029c37a32d7e4951449e197d4850213

  • SHA1

    6ed7bb726b1e04d6858c084bc9bf475a13b77c95

  • SHA256

    fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c

  • SHA512

    bf3639710e259aa38d0cd028071408bdd41c01ee1bd0ea70a16ada78b848c63886854ed40407242e3a68fd9b5444fce2e6ddc050e0c8a2f578b00f43b6c52b6f

  • SSDEEP

    384:EB8JbJPKd1Bf3rNeD9k4NcKlb5sCSvyP5CtrCzYcHe+Z:EBCNPKd155ulNzxoUzYcHe+Z

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
    "C:\Users\Admin\AppData\Local\Temp\fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3740-0-0x00007FFD97AE5000-0x00007FFD97AE6000-memory.dmp

    Filesize

    4KB

  • memory/3740-1-0x000000001C510000-0x000000001C9DE000-memory.dmp

    Filesize

    4.8MB

  • memory/3740-2-0x000000001C9E0000-0x000000001CA86000-memory.dmp

    Filesize

    664KB

  • memory/3740-3-0x00007FFD97830000-0x00007FFD981D1000-memory.dmp

    Filesize

    9.6MB

  • memory/3740-4-0x000000001CB00000-0x000000001CB62000-memory.dmp

    Filesize

    392KB

  • memory/3740-5-0x00007FFD97830000-0x00007FFD981D1000-memory.dmp

    Filesize

    9.6MB

  • memory/3740-6-0x00007FFD97AE5000-0x00007FFD97AE6000-memory.dmp

    Filesize

    4KB

  • memory/3740-7-0x00007FFD97830000-0x00007FFD981D1000-memory.dmp

    Filesize

    9.6MB