May 21, 2023, 5:25 p.m. | /u/amjcyb

For [Blue|Purple] Teams in Cyber Defence www.reddit.com

Hi there!
I'm analyzing a malware sample that is calling a C2, sets a persistence in registry, injects in svchost.exe, this svchost calls a second C2 and terminates the process.

I guess the malware is injecting a second shellcode in svchost but as the process kills itself I can not dump it and do some forensics to see the shellcode.

Any ideas about what else could I do?

blueteamsec malware memory persistence process registry shellcode

Social Engineer For Reverse Engineering Exploit Study

@ Independent study | Remote

Data Privacy Manager m/f/d)

@ Coloplast | Hamburg, HH, DE

Cybersecurity Sr. Manager

@ Eastman | Kingsport, TN, US, 37660

KDN IAM Associate Consultant

@ KPMG India | Hyderabad, Telangana, India

Learning Experience Designer in Cybersecurity (f/m/div.) (Salary: ~113.000 EUR p.a.*)

@ Bosch Group | Stuttgart, Germany

Senior Security Engineer - SIEM

@ Samsara | Remote - US