Resubmissions
11/11/2021, 01:05
211111-bfj74saed3111/11/2021, 01:01
211111-bdh72aaec8110/11/2021, 10:21
211110-mdncjadhgn1Analysis
- max time kernel
105s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
10/11/2021, 10:21
General
- Target Bill.10099_2.xll.dll
- Size 647KB
- Sample211110-mdncjadhgn
- SHA256 ecced63b75f7967f2ec05955217d6e30bb45cb0dc7d620213defacf33174e953
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-119-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
memory/2412-120-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
memory/2412-121-0x0000000003FD0000-0x0000000003FDC000-memory.dmp
memory/2412-123-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
memory/2412-127-0x00000000065F0000-0x000000000676E000-memory.dmp
memory/2412-136-0x0000000007990000-0x00000000079C6000-memory.dmp
memory/2412-140-0x0000000006562000-0x0000000006563000-memory.dmp
memory/2412-139-0x0000000006560000-0x0000000006561000-memory.dmp
memory/2412-141-0x0000000006563000-0x0000000006564000-memory.dmp
memory/2412-142-0x0000000006564000-0x0000000006566000-memory.dmp
memory/2412-143-0x0000000006566000-0x0000000006568000-memory.dmp
memory/2412-144-0x0000000007F00000-0x0000000007F01000-memory.dmp
memory/2412-145-0x0000000007B00000-0x0000000007B01000-memory.dmp
memory/2412-146-0x0000000007AB0000-0x0000000007AB1000-memory.dmp
memory/2412-147-0x0000000007AC0000-0x0000000007ACA000-memory.dmp
memory/2412-150-0x0000000009400000-0x0000000009401000-memory.dmp
memory/2412-151-0x0000000003FB0000-0x0000000003FB1000-memory.dmp