Analysis
- max time kernel
95s - max time network
113s - platform
windows10_x64 - resource
win10 - submitted
24/10/2020, 06:38
General
- Target New purchase order 50,689$.exe
- Size 1.0MB
- Sample201024-hws22e5qlx
- SHA256 73daa7c456a2dc8ebb8b372c752253c4d70ee390e35cc37b25f56571d31143ca
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New purchase order 50,689$.exe"C:\Users\Admin\AppData\Local\Temp\New purchase order 50,689$.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-9-0x0000000000400000-0x0000000000444000-memory.dmp
memory/2412-11-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3496-0-0x0000000073F20000-0x000000007460E000-memory.dmp
memory/3496-1-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/3496-3-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3496-4-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/3496-5-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/3496-6-0x0000000008400000-0x0000000008401000-memory.dmp
memory/3496-7-0x0000000004E80000-0x0000000004E96000-memory.dmp
memory/3496-8-0x0000000008810000-0x00000000088D8000-memory.dmp