Analysis
- max time kernel
86s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
02/12/2020, 06:52
General
- Target signed_19272.exe
- Size 762KB
- Sample201202-weggxtjypj
- SHA256 badf7e8ef826b51aaa028ec3a296f7b9432474d8b6377552f0dcbfd520c0df47
Malware Config
Signatures
- ServiceHost packer 5 IoCs
Detects ServiceHost packer used for .NET malware
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\signed_19272.exe"C:\Users\Admin\AppData\Local\Temp\signed_19272.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7083⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2680-2-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3012-24-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-28-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-5-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/3012-12-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-13-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/3012-14-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-15-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-16-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-17-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-18-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-20-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-21-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-23-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-19-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-22-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-25-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-26-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-27-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-6-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/3012-29-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-30-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-31-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-32-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-34-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-33-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-36-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-37-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-35-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-40-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-39-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-41-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-42-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-43-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-44-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-38-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-45-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-48-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-47-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3012-46-0x00000000009B0000-0x00000000009B1000-memory.dmp