Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat1003/02/2025, 04:37
250203-e896saslgn1031/01/2025, 18:35
250131-w8gmxatmc110Analysis
- max time kernel
899s - max time network
542s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250128-en - resource tags
- submitted
03/02/2025, 04:37
General
- Target bazaar.2020.02/HEUR-Backdoor.MSIL.Revenge.exe
- Size 16KB
- Sample250203-e896saslgn
- SHA256 c35e3bdf0d1a7275e73f3c8c9fb57cf874ffa19ffafae649025b1e90cd07c096
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Revenge.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Revenge.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4084-0-0x00007FFB79B25000-0x00007FFB79B26000-memory.dmp
memory/4084-2-0x000000001C270000-0x000000001C73E000-memory.dmp
memory/4084-1-0x00007FFB79870000-0x00007FFB7A211000-memory.dmp
memory/4084-3-0x000000001BC20000-0x000000001BCC6000-memory.dmp
memory/4084-4-0x000000001C7B0000-0x000000001C812000-memory.dmp
memory/4084-5-0x00007FFB79870000-0x00007FFB7A211000-memory.dmp
memory/4084-6-0x00007FFB79B25000-0x00007FFB79B26000-memory.dmp
memory/4084-7-0x00007FFB79870000-0x00007FFB7A211000-memory.dmp