Resubmissions
27/05/2025, 19:20
250527-x2bnraep6t1011/03/2025, 16:30
250311-tz8zpaxrz21011/03/2025, 16:06
250311-tkc9gaxm161011/03/2025, 16:06
250311-tj3sqsxm131010/03/2025, 17:34
250310-v5yatasnz91020/02/2025, 10:50
250220-mw8festjaz1020/02/2025, 10:49
250220-mw12cavpw61016/02/2025, 02:33
250216-c1244ayjc11016/02/2025, 02:26
250216-cw6xgsxldq1012/02/2025, 14:54
250212-r9zgwswmej10Analysis
- max time kernel
575s - max time network
585s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
11/03/2025, 16:06
General
- Target beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
- Size 8.5MB
- Sample250311-tkc9gaxm16
- SHA256 beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e91⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\print.exe"C:\Windows\system32\print.exe" h92⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zfgco1hj.p11.ps1
memory/2832-16-0x000001EC26440000-0x000001EC264B6000-memory.dmp
memory/2832-12-0x000001EC0D5A0000-0x000001EC0D5C2000-memory.dmp
memory/2832-13-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-14-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-15-0x000001EC25750000-0x000001EC25794000-memory.dmp
memory/2832-2-0x00007FFD3C233000-0x00007FFD3C235000-memory.dmp
memory/2832-18-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-19-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-20-0x00007FFD3C233000-0x00007FFD3C235000-memory.dmp
memory/2832-21-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-23-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-26-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-27-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp
memory/2832-31-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp