seon | 221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea

Analysis

max time kernel
108s
max time network
154s
platform
windows10_x64
resource
win10v191014
submitted
10/02/2020, 12:03

Sharing

Copy URL Twitter E-mail

General

Target
seon.exe
Size 62KB
Sample200210-k5jpd8nvyn
SHA256 221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea
MD5 7d3573bee1a9acd192c50bc72a65ef7a
SHA1 8ff77e69046c8cecd4407c536219e6fc1a747af7
SHA512 dcf3998861c2c1818d05ba526134edddee58bea51d4065ec5d156dfac2d24a63d65df057a1319e0886bdf37a394f82fb4435c0292c3e1f135646623ad3aaf347
MD5 SHA1 SHA512

Score

10^/10

trojan ransomware seon

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1760	5016	seon.exe	75
PID 5016 wrote to memory of 1760	5016	seon.exe	75
PID 5016 wrote to memory of 1760	5016	seon.exe	75

Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
trojan ransomware seon

Discovering connected drives 3 TTPs 5 IoCs

ransomware

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	seon.exe
File opened (read-only)	\??\F:	seon.exe
File opened (read-only)	\??\A:	seon.exe
File opened (read-only)	\??\B:	seon.exe
File opened (read-only)	\??\C:	seon.exe

C:\Users\Admin\AppData\Local\Temp\seon.exe
"C:\Users\Admin\AppData\Local\Temp\seon.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Discovering connected drives
PID:5016
- C:\Windows\SysWOW64\mshta.exe
  mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
  2⤵
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads