Analysis
-
max time kernel
129s -
max time network
44s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
01-07-2020 02:06
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe
-
Size
408KB
-
MD5
88b0f459caad3deae8912c4779ffce10
-
SHA1
ce774b12dea756c6f0a460d542e12787cb595d5e
-
SHA256
b724556bd0d2324ae566eb3a0c2f433bdbb2d2e4d83d4e6e0058d6c8b1edf188
-
SHA512
9ea5244e9f15346fc6f14179d33f820b5377613be52b967ede59cd5aac1989d4d4cb11b024fec42f605121763fdc194857cce71d7bbfac2fc9fb129a3f091972
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exedescription pid process target process PID 1600 set thread context of 2512 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2512 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 2512 RegAsm.exe 2512 RegAsm.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exedescription pid process target process PID 1600 wrote to memory of 2484 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2484 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2484 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2512 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2512 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2512 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe PID 1600 wrote to memory of 2512 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exepid process 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe 1600 SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.348.12471.29763.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses