Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
12/05/2025, 04:28
General
- Target SecuriteInfo.com.Variant.Lazy.654159.588.21676.exe
- Size 2.7MB
- Sample250512-e3pmwsem9v
- SHA256 2b696ba0ea5ea7f35dcd39be430a8880034490f3d1c5f2219fed2d06376a21a3
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.654159.588.21676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.654159.588.21676.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4892-0-0x0000000000DA0000-0x000000000104C000-memory.dmp
memory/4892-1-0x0000000074DCE000-0x0000000074DCF000-memory.dmp
memory/4892-2-0x0000000005B90000-0x0000000006134000-memory.dmp
memory/4892-3-0x0000000005680000-0x0000000005712000-memory.dmp
memory/4892-4-0x0000000005600000-0x000000000560A000-memory.dmp
memory/4892-5-0x0000000005720000-0x00000000057BA000-memory.dmp
memory/4892-6-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/4892-7-0x00000000058E0000-0x00000000058FA000-memory.dmp
memory/4892-9-0x0000000005900000-0x00000000059BE000-memory.dmp
memory/4892-10-0x0000000005A00000-0x0000000005A28000-memory.dmp
memory/4892-11-0x0000000005A30000-0x0000000005A38000-memory.dmp
memory/4892-12-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/4892-22-0x0000000006190000-0x000000000619A000-memory.dmp
memory/4892-23-0x0000000009370000-0x000000000940C000-memory.dmp
memory/4892-24-0x0000000009890000-0x00000000098F6000-memory.dmp
memory/4892-25-0x0000000074DCE000-0x0000000074DCF000-memory.dmp
memory/4892-26-0x0000000074DC0000-0x0000000075570000-memory.dmp