Analysis
- max time kernel
122s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/02/2021, 17:14
General
- Target SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe
- Size 753KB
- Sample210209-9kshqh5vqs
- SHA256 17597ccb6afea30a3cd4d4ad8d31bd2d659f72deb76c32e65820e164d80dc853
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.535.12894.30308.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1160-2-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/1160-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/1160-5-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/1160-6-0x0000000005870000-0x0000000005871000-memory.dmp
memory/1160-7-0x0000000005910000-0x0000000005911000-memory.dmp
memory/1160-8-0x0000000005850000-0x0000000005851000-memory.dmp
memory/1160-9-0x0000000006320000-0x0000000006321000-memory.dmp
memory/1160-10-0x00000000065A0000-0x00000000065A1000-memory.dmp
memory/1160-11-0x00000000064E0000-0x00000000064E4000-memory.dmp
memory/1160-12-0x00000000016D0000-0x0000000001736000-memory.dmp
memory/2040-13-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2040-15-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/2040-20-0x0000000005680000-0x0000000005681000-memory.dmp
memory/2040-21-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/2040-22-0x0000000006370000-0x0000000006371000-memory.dmp