Analysis
- max time kernel
109s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
- submitted
15/01/2025, 04:04
General
- Target 18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe
- Size 205KB
- Sample250115-emykvsslcp
- SHA256 18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"C:\Users\Admin\AppData\Local\Temp\18f3749e057ca1d3899cb27c94dac6394e3716ab46be15e98594865e74b779bd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-0-0x000000007495E000-0x000000007495F000-memory.dmp
memory/788-1-0x00000000005B0000-0x00000000005EA000-memory.dmp
memory/788-2-0x00000000055A0000-0x0000000005B46000-memory.dmp
memory/788-3-0x00000000050D0000-0x0000000005162000-memory.dmp
memory/788-4-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-5-0x00000000068D0000-0x00000000069F8000-memory.dmp
memory/788-21-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-7-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-37-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-43-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-69-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-35-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-67-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-63-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-61-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-59-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-57-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-55-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-53-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-51-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-47-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-45-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-41-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-39-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-33-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-66-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-31-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-49-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-29-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-27-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-26-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-23-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-19-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-17-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-15-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-13-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-11-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-9-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-6-0x00000000068D0000-0x00000000069F2000-memory.dmp
memory/788-1328-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1329-0x0000000006A70000-0x0000000006AF2000-memory.dmp
memory/788-1330-0x0000000006B30000-0x0000000006BB0000-memory.dmp
memory/788-1331-0x0000000006C20000-0x0000000006C6C000-memory.dmp
memory/788-1332-0x000000007495E000-0x000000007495F000-memory.dmp
memory/788-1333-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1334-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1335-0x00000000060C0000-0x0000000006114000-memory.dmp
memory/788-1336-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1340-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1342-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1343-0x0000000074950000-0x0000000075101000-memory.dmp
memory/788-1352-0x0000000074950000-0x0000000075101000-memory.dmp
memory/3124-1353-0x0000000074950000-0x0000000075101000-memory.dmp
memory/3124-2676-0x0000000074950000-0x0000000075101000-memory.dmp