General
- Target lol11.exe
- Size 1.9MB
- Sample260812-psd4hsxaqc
- SHA256 e01108a2c1db9807c3a7ca8fc19d3a900857c401995d8a00255556a8c895bf37
Score
10/10
Malware Config
Targets
-
- Target lol11.exe
- Size 1.9MB
- SHA256 e01108a2c1db9807c3a7ca8fc19d3a900857c401995d8a00255556a8c895bf37
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1