svcready | cbdff24fc9b0ca1753991b7cbc78b292bf1b431f98d93927336f2aa676249c14 | Triage

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 11:04

Sharing

Report Analysis Logs

General

Target

bf9868e8c622948631947a159ac1e9ba.dll
Size

1.1MB
MD5

bf9868e8c622948631947a159ac1e9ba
SHA1

c2c9c0921192aea133411a3600808be5e05bb075
SHA256

cbdff24fc9b0ca1753991b7cbc78b292bf1b431f98d93927336f2aa676249c14
SHA512

9d4639a7c3cffbaefaa51fedc438d027b32bbbf1c35c5be1ac06bd6c5c92d6ad4d4b50d5397877496a983e652920de57d0ef6e56879ed033fb44c638a633fb62

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3260-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3816 wrote to memory of 3260	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 3260	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 3260	3816	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf9868e8c622948631947a159ac1e9ba.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf9868e8c622948631947a159ac1e9ba.dll
  2⤵
  PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3260-130-0x0000000000000000-mapping.dmp

Download
memory/3260-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download