Analysis
- max time kernel
8s - max time network
13s - platform
windows7_x64 - resource
win7v20201028 - submitted
26/12/2020, 08:13
General
- Target BitCoin Updated Security Terms and Policy.exe
- Size 253KB
- Sample201226-eyef1dn2ce
- SHA256 ea8f64464c29c09b37c9f05be40718e144a375aeb920ed699fb3dea644d508aa
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BitCoin Updated Security Terms and Policy.exe"C:\Users\Admin\AppData\Local\Temp\BitCoin Updated Security Terms and Policy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Drops startup file
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/836-6-0x0000000000400000-0x000000000040C000-memory.dmp
memory/836-8-0x0000000000400000-0x000000000040C000-memory.dmp
memory/836-9-0x0000000000400000-0x000000000040C000-memory.dmp
memory/836-10-0x0000000073D90000-0x000000007447E000-memory.dmp
memory/1684-2-0x0000000074110000-0x00000000747FE000-memory.dmp
memory/1684-3-0x0000000001120000-0x0000000001121000-memory.dmp
memory/1684-5-0x00000000001E0000-0x00000000001F2000-memory.dmp