Analysis
- max time kernel
148s - max time network
126s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
03/07/2024, 15:27
General
- Target file.exe
- Size 959KB
- Sample240703-svsapswbpd
- SHA256 16a7347fc7b7eb611e341bff5d6a7fdf6ab600e30c0b71dac8e672e2e7857c47
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\convert.exe"C:\Windows\SysWOW64\convert.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1188-30-0x0000000009010000-0x000000000B4DD000-memory.dmp
memory/1188-22-0x0000000009010000-0x000000000B4DD000-memory.dmp
memory/1188-21-0x0000000003A60000-0x0000000003B60000-memory.dmp
memory/2980-15-0x00000000748F0000-0x0000000074FDE000-memory.dmp
memory/2980-1-0x00000000010B0000-0x00000000011A6000-memory.dmp
memory/2980-2-0x00000000748F0000-0x0000000074FDE000-memory.dmp
memory/2980-3-0x0000000000570000-0x000000000058A000-memory.dmp
memory/2980-4-0x0000000000390000-0x0000000000398000-memory.dmp
memory/2980-5-0x0000000000520000-0x000000000052C000-memory.dmp
memory/2980-6-0x0000000004ED0000-0x0000000004F96000-memory.dmp
memory/2980-0-0x00000000748FE000-0x00000000748FF000-memory.dmp
memory/3060-17-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-25-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-16-0x0000000000910000-0x0000000000C13000-memory.dmp
memory/3060-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/3060-18-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-19-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-20-0x00000000001F0000-0x0000000000212000-memory.dmp
memory/3060-14-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-13-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-7-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-9-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3060-26-0x00000000001F0000-0x0000000000212000-memory.dmp
memory/3064-23-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/3064-27-0x0000000002390000-0x0000000002693000-memory.dmp
memory/3064-28-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/3064-29-0x0000000002970000-0x0000000002A11000-memory.dmp
memory/3064-24-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/3064-31-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/3064-32-0x0000000002970000-0x0000000002A11000-memory.dmp