Analysis
- max time kernel
111s - max time network
9s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/02/2021, 17:14
General
- Target SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe
- Size 753KB
- Sample210209-9kshqh5vqs
- SHA256 17597ccb6afea30a3cd4d4ad8d31bd2d659f72deb76c32e65820e164d80dc853
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1536-8-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1536-10-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/1536-11-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1536-13-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/1576-2-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/1576-3-0x00000000103C0000-0x00000000103C1000-memory.dmp
memory/1576-5-0x0000000004940000-0x0000000004941000-memory.dmp
memory/1576-6-0x0000000000590000-0x0000000000594000-memory.dmp
memory/1576-7-0x00000000020A0000-0x0000000002106000-memory.dmp