Analysis
- max time kernel
112s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/06/2021, 09:52
General
- Target SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe
- Size 1.1MB
- Sample210602-s3rypp87ex
- SHA256 e0a0c2bb0b0436bb613bd1eb9142edf9f09166349a12c71045eeb99c13d154c5
Score
7/10
Malware Config
Signatures
- Uses the VBS compiler for execution 1 TTPs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3932-114-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3932-116-0x0000000005180000-0x0000000005181000-memory.dmp
memory/3932-117-0x0000000005720000-0x0000000005721000-memory.dmp
memory/3932-118-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/3932-119-0x0000000005260000-0x0000000005261000-memory.dmp
memory/3932-120-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3932-121-0x0000000005220000-0x000000000571E000-memory.dmp
memory/3932-122-0x00000000052A0000-0x00000000052B4000-memory.dmp
memory/3932-123-0x0000000005EC0000-0x0000000005F85000-memory.dmp
memory/3932-124-0x0000000008440000-0x00000000084CE000-memory.dmp