Resubmissions
11/11/2021, 01:05
211111-bfj74saed3111/11/2021, 01:01
211111-bdh72aaec8110/11/2021, 10:21
211110-mdncjadhgn1Analysis
- max time kernel
24s - max time network
24s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
11/11/2021, 01:01
General
- Target Bill.10099_2.xll.dll
- Size 647KB
- Sample211111-bdh72aaec8
- SHA256 ecced63b75f7967f2ec05955217d6e30bb45cb0dc7d620213defacf33174e953
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Bill.10099_2.xll.dll2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2112-117-0x0000000003390000-0x0000000003391000-memory.dmp
memory/2112-116-0x0000000003390000-0x0000000003391000-memory.dmp
memory/2112-118-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/2112-119-0x0000000004D10000-0x0000000004D1C000-memory.dmp
memory/2112-121-0x0000000003390000-0x0000000003391000-memory.dmp
memory/2112-125-0x00000000072F0000-0x000000000746E000-memory.dmp
memory/2112-134-0x0000000008690000-0x00000000086C6000-memory.dmp
memory/2112-135-0x0000000004EF2000-0x0000000004EF3000-memory.dmp
memory/2112-136-0x0000000004EF3000-0x0000000004EF4000-memory.dmp
memory/2112-139-0x0000000004EF4000-0x0000000004EF6000-memory.dmp
memory/2112-140-0x0000000008BD0000-0x0000000008BD1000-memory.dmp
memory/2112-141-0x00000000087C0000-0x00000000087C1000-memory.dmp
memory/2112-142-0x0000000008770000-0x0000000008771000-memory.dmp
memory/2112-143-0x0000000004EF6000-0x0000000004EF8000-memory.dmp
memory/2112-144-0x0000000008780000-0x000000000878A000-memory.dmp
memory/2112-147-0x000000000A0D0000-0x000000000A0D1000-memory.dmp
memory/2112-148-0x0000000003390000-0x0000000003391000-memory.dmp