Resubmissions
25/10/2021, 09:39
211025-lmzw9aghbp125/10/2021, 09:33
211025-ljfzzagaa51025/10/2021, 07:58
211025-jttygaggdk1Analysis
- max time kernel
73s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
25/10/2021, 07:58
General
- Target PO # RSLDH102115239.xll.dll
- Size 637KB
- Sample211025-jttygaggdk
- SHA256 994013d66ae20cfa4ef1097d73481b00a672131d0de44d79a04ff12f492aae55
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\PO # RSLDH102115239.xll.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\PO # RSLDH102115239.xll.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4304-117-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/4304-116-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/4304-118-0x0000000006830000-0x0000000006831000-memory.dmp
memory/4304-119-0x0000000006730000-0x0000000006747000-memory.dmp
memory/4304-121-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/4304-130-0x0000000006833000-0x0000000006834000-memory.dmp
memory/4304-129-0x0000000006832000-0x0000000006833000-memory.dmp
memory/4304-131-0x0000000006834000-0x0000000006836000-memory.dmp
memory/4304-132-0x0000000006970000-0x00000000069A6000-memory.dmp
memory/4304-135-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/4304-136-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
memory/4304-137-0x0000000006A90000-0x0000000006A91000-memory.dmp
memory/4304-138-0x0000000006836000-0x0000000006838000-memory.dmp
memory/4304-139-0x0000000006AA0000-0x0000000006AA2000-memory.dmp
memory/4304-146-0x0000000002BF0000-0x0000000002BF1000-memory.dmp