Analysis
- max time kernel
62s - max time network
63s - platform
windows7_x64 - resource
win7 - submitted
08/07/2020, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe
- Size 88KB
- Sample200708-h82csp5pr2
- SHA256 a26a8103df2d4fd152def868cfead5e1e2c9b333d0d0110cee02c06a98f1c188
- MD5 ba7cce6da078c2825b05ee305773edb6
- SHA1 3f823143e545b627759b644fc2d570b08e418ca7
- SHA512 0e725d372ec4c095d76dbc5875105ede1ceeb2ac62ec20c6d53d6ef21e929d63b785d30fc09d359b635de96b3b67f1f361a105f733dfa06c6dacad40849152d7
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Kills process with taskkill 2 IoCs
pid Process 276 taskkill.exe 1060 taskkill.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1104 wrote to memory of 608 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 24 PID 1104 wrote to memory of 608 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 24 PID 1104 wrote to memory of 608 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 24 PID 1104 wrote to memory of 608 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 24 PID 608 wrote to memory of 1408 608 cmd.exe 26 PID 608 wrote to memory of 1408 608 cmd.exe 26 PID 608 wrote to memory of 1408 608 cmd.exe 26 PID 608 wrote to memory of 1408 608 cmd.exe 26 PID 1104 wrote to memory of 276 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 28 PID 1104 wrote to memory of 276 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 28 PID 1104 wrote to memory of 276 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 28 PID 1104 wrote to memory of 276 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 28 PID 1104 wrote to memory of 1060 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 30 PID 1104 wrote to memory of 1060 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 30 PID 1104 wrote to memory of 1060 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 30 PID 1104 wrote to memory of 1060 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 30 PID 1104 wrote to memory of 1792 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 33 PID 1104 wrote to memory of 1792 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 33 PID 1104 wrote to memory of 1792 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 33 PID 1104 wrote to memory of 1792 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 33 PID 1104 wrote to memory of 1868 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 35 PID 1104 wrote to memory of 1868 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 35 PID 1104 wrote to memory of 1868 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 35 PID 1104 wrote to memory of 1868 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 35 PID 1104 wrote to memory of 1604 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 37 PID 1104 wrote to memory of 1604 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 37 PID 1104 wrote to memory of 1604 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 37 PID 1104 wrote to memory of 1604 1104 SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe 37 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1408 tasklist.exe Token: SeDebugPrivilege 276 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe - Deletes itself 1 IoCs
pid Process 1604 cmd.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1408 tasklist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist > "C:\Users\Admin\AppData\Local\Temp\process.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
- Enumerates processes with tasklist
PID:1408
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM svmm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:276
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM svm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe"2⤵PID:1792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c RMDIR /S /Q "C:\Program Files (x86)\svm"2⤵PID:1868
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.17877.exe"2⤵
- Deletes itself
PID:1604
-