Resubmissions
11/11/2021, 01:05
211111-bfj74saed3111/11/2021, 01:01
211111-bdh72aaec8110/11/2021, 10:21
211110-mdncjadhgn1Analysis
- max time kernel
3s - max time network
2s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
11/11/2021, 01:01
General
- Target Bill.10099_2.xll.dll
- Size 647KB
- Sample211111-bdh72aaec8
- SHA256 ecced63b75f7967f2ec05955217d6e30bb45cb0dc7d620213defacf33174e953
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/320-57-0x0000000075C51000-0x0000000075C53000-memory.dmp
memory/320-58-0x0000000000250000-0x000000000025C000-memory.dmp
memory/320-60-0x00000000049A0000-0x0000000004B1E000-memory.dmp
memory/320-61-0x00000000009F0000-0x0000000000A26000-memory.dmp
memory/320-62-0x0000000004681000-0x0000000004682000-memory.dmp
memory/320-64-0x0000000004683000-0x0000000004684000-memory.dmp
memory/320-63-0x0000000004682000-0x0000000004683000-memory.dmp
memory/320-65-0x0000000004684000-0x0000000004686000-memory.dmp
memory/320-66-0x0000000000760000-0x000000000076A000-memory.dmp
memory/320-67-0x000000000468A000-0x000000000469B000-memory.dmp
memory/1140-55-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp