Task
task1
Task
task2
General
-
Target
Exes_95a73842672ac3f89618c5db39497de1.jpg
-
Sample
190726-ck7632vmqx
-
SHA256
8a44c7afbb4d00b448c57765477df5c4f5a8df7dbb85a2ff746ec8dc9457481f
Score
N/A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid PID 1272 wrote to memory of 1484 1484 -
Adds Run entry to start application 2 TTPs 2 IoCs
description \REGISTRY\USER\S-1-5-21-1680029378-2711335550-577619594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ \REGISTRY\USER\S-1-5-21-1680029378-2711335550-577619594-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" -
Suspicious behavior: EnumeratesProcesses
-
troldesh family