Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
23/07/2022, 16:17
General
- Target pelagagge_doc_22.07.22.docm
- Size 3.3MB
- Sample220723-trcxaaffcl
- SHA256 492634563551d944bb219f40b9b78694dd23377013023de597047ff4f9ecbff8
Malware Config
Signatures
- Detects SVCReady loader 1 IoCs
- SVCReady
SVCReady is a malware loader first seen in April 2022.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\pelagagge_doc_22.07.22.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\r7862.tmp.exe"C:\Users\Admin\AppData\Local\Temp\r7862.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\y7861.tmp.dll",DllRegisterServer2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
r7862.tmp.exe
r7862.tmp.exe
y7861.tmp.dll
y7861.tmp.dll
memory/1680-141-0x0000000010000000-0x0000000010091000-memory.dmp
memory/4584-135-0x00007FF8B83D0000-0x00007FF8B83E0000-memory.dmp
memory/4584-136-0x00007FF8B83D0000-0x00007FF8B83E0000-memory.dmp
memory/4584-131-0x00007FF8BA430000-0x00007FF8BA440000-memory.dmp
memory/4584-134-0x00007FF8BA430000-0x00007FF8BA440000-memory.dmp
memory/4584-133-0x00007FF8BA430000-0x00007FF8BA440000-memory.dmp
memory/4584-132-0x00007FF8BA430000-0x00007FF8BA440000-memory.dmp
memory/4584-130-0x00007FF8BA430000-0x00007FF8BA440000-memory.dmp
memory/4584-147-0x000001F2F1302000-0x000001F2F14E5000-memory.dmp
memory/4584-148-0x000001F2F0F30000-0x000001F2F1026000-memory.dmp
memory/4584-149-0x000001F2F1180000-0x000001F2F12B8000-memory.dmp
memory/4584-150-0x000001F2F0F30000-0x000001F2F1026000-memory.dmp