8916a2ccfa61771ecb3ace5da83e029f1ba683f36016fafc50922c9a5615b625 | Triage™

Analysis

max time kernel
150s
max time network
94s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe
Size 872KB
Sample200707-xkfvb768cn
SHA256 8916a2ccfa61771ecb3ace5da83e029f1ba683f36016fafc50922c9a5615b625
MD5 24286c2c37d56443331f1bca960eb51d
SHA1 243f198205eeadf8abcab4b7626084fc53e712e1
SHA512 b07f89cbfaf2e24c6574c28c4f3d18eab67de09d4f3363b1c1fcb0037a15f5cb80f5193884ffd9c742682a332e24541707a7d68ef11c13bcae07687066bcf2f8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3692	SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe
3692	SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
624	Process not Found
624	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3692	SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NtRootKit.18405.11776.1149.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: GetForegroundWindowSpam
PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads