Analysis
- max time kernel
51s - max time network
49s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
08/09/2022, 10:59
General
- Target SecuriteInfo.com.Win32.PWSX-gen.5781.exe
- Size 1.1MB
- Sample220908-m3dvdsedc8
- SHA256 d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1136-60-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1136-61-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1136-63-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1136-66-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1136-67-0x0000000000401000-0x000000000042D000-memory.dmp
memory/1136-68-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/1440-55-0x0000000076181000-0x0000000076183000-memory.dmp
memory/1440-56-0x0000000000740000-0x000000000075A000-memory.dmp
memory/1440-57-0x0000000000630000-0x000000000063C000-memory.dmp
memory/1440-58-0x0000000005FE0000-0x000000000606E000-memory.dmp
memory/1440-59-0x0000000000DF0000-0x0000000000E24000-memory.dmp
memory/1440-54-0x0000000000EC0000-0x0000000000FE8000-memory.dmp