svcready | 08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273 | Triage

Resubmissions

05-07-2022 14:19

220705-rmtywsbhg7 10

09-06-2022 16:14

220609-tpy2qsebe7 1

07-06-2022 11:35

220607-np1mnsead7 1

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05-07-2022 14:19

Sharing

Report Analysis Logs

General

Target

y3036.tmp.dll
Size

557KB
MD5

d19c5e1fb2d895ff61c0ff89cd0fc1a0
SHA1

89900c9532f88bd58382ced3ee0bc86413e0fce0
SHA256

08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273
SHA512

e3dfb8c680b9575a2ffdbedfc988392bb67833c5c3c1ca23fbbf4c1a086bcacbc287c1fa3f648f60238e8e292b521f864312f5c8bba8c93057b8fe4982d14ba7

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3368-131-0x00000000750F0000-0x0000000075181000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3156 wrote to memory of 3368	3156	rundll32.exe	rundll32.exe
PID 3156 wrote to memory of 3368	3156	rundll32.exe	rundll32.exe
PID 3156 wrote to memory of 3368	3156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
  2⤵
  PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3368-130-0x0000000000000000-mapping.dmp

Download
memory/3368-131-0x00000000750F0000-0x0000000075181000-memory.dmp

Filesize
580KB

Download