Resubmissions
11/11/2021, 01:05
211111-bfj74saed3111/11/2021, 01:01
211111-bdh72aaec8110/11/2021, 10:21
211110-mdncjadhgn1Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
10/11/2021, 10:21
General
- Target Bill.10099_2.xll.dll
- Size 647KB
- Sample211110-mdncjadhgn
- SHA256 ecced63b75f7967f2ec05955217d6e30bb45cb0dc7d620213defacf33174e953
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/776-57-0x0000000076081000-0x0000000076083000-memory.dmp
memory/776-58-0x00000000002A0000-0x00000000002AC000-memory.dmp
memory/776-60-0x0000000004981000-0x0000000004982000-memory.dmp
memory/776-61-0x0000000004982000-0x0000000004983000-memory.dmp
memory/776-62-0x00000000047F0000-0x000000000496E000-memory.dmp
memory/776-63-0x0000000000B00000-0x0000000000B36000-memory.dmp
memory/776-64-0x0000000004983000-0x0000000004984000-memory.dmp
memory/776-65-0x0000000000650000-0x000000000065A000-memory.dmp
memory/776-66-0x0000000004984000-0x0000000004986000-memory.dmp
memory/776-67-0x000000000498A000-0x000000000499B000-memory.dmp
memory/840-55-0x000007FEFC061000-0x000007FEFC063000-memory.dmp