Analysis
- max time kernel
106s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
29/07/2021, 16:25
General
- Target f9403f5b6853a153df2c4ba4c6e36dbb.exe
- Size 4.3MB
- Sample210729-9sa8bcs1es
- SHA256 22dd8611d03e9f4cfb6e55ad748bc0fd1fb7377f5f39b26c843069a3dcf5b947
Malware Config
Signatures
- Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9403f5b6853a153df2c4ba4c6e36dbb.exe"C:\Users\Admin\AppData\Local\Temp\f9403f5b6853a153df2c4ba4c6e36dbb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1324-123-0x0000000000400000-0x0000000000A58000-memory.dmp
memory/1324-139-0x000002C9D9136000-0x000002C9D9137000-memory.dmp
memory/1324-138-0x000002C9D9135000-0x000002C9D9136000-memory.dmp
memory/1324-137-0x000002C9D9133000-0x000002C9D9135000-memory.dmp
memory/1324-136-0x000002C9D9130000-0x000002C9D9132000-memory.dmp
memory/1324-135-0x0000000000400000-0x0000000000A58000-memory.dmp
memory/1324-131-0x000002C9D9570000-0x000002C9D9990000-memory.dmp
memory/4012-118-0x000000001E520000-0x000000001E521000-memory.dmp
memory/4012-122-0x0000000020070000-0x000000002067A000-memory.dmp
memory/4012-121-0x0000000001CC0000-0x0000000001CC1000-memory.dmp
memory/4012-120-0x0000000001CB0000-0x0000000001CC0000-memory.dmp
memory/4012-119-0x000000001E6F0000-0x000000001ED11000-memory.dmp
memory/4012-114-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/4012-117-0x0000000001D70000-0x0000000001D72000-memory.dmp
memory/4012-116-0x000000001D4F0000-0x000000001DD1D000-memory.dmp