svcready | 5b8a23e134ce3e082142b3ecd36a26605776f21550e4ba03b6e15b450f59456b | Triage

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 07:22

Sharing

Report Analysis Logs

General

Target

f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
Size

1.1MB
MD5

7e4722c69a08c97e5f2cdd2e78c091f3
SHA1

831ae50906861832a64e61bf006d943e7fb3fac9
SHA256

f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807
SHA512

07be715ee6c245c40b618509340f90a8a6677b0525047d6808d8a4b75831e4f22f7348f31efec5deba87e7ec7042e139cefcb9fdfd7231f6518b4f14d8d7b0fc

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4744-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 2864 wrote to memory of 4744	2864	regsvr32.exe	81
PID 2864 wrote to memory of 4744	2864	regsvr32.exe	81
PID 2864 wrote to memory of 4744	2864	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
  2⤵
  PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-130-0x0000000000000000-mapping.dmp

Download
memory/4744-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download