Analysis
-
max time kernel
147s -
max time network
28s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 13:11
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
-
Size
84KB
-
MD5
a4e39f608731d31fbcc17d98a3ec8508
-
SHA1
6f36f07b4e5efbf35b4b1f7916a7047db9b49535
-
SHA256
8215972987c85e180e7df1a17bac6575df92fe882d0092bf470d2ce651db2585
-
SHA512
673b10d5e3740f1d5585e5c647006b81dbf784f67655c684ae982bd87e21b8f98ef3631c197e9b8e18fcf3c453a267942e3d2dd5f0f01b9670cb38c9f1932aee
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1740 cmd.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 852 taskkill.exe 1408 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exepid process 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exedescription pid process target process PID 1292 wrote to memory of 852 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 852 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 852 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 852 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 1408 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 1408 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 1408 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 1408 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe taskkill.exe PID 1292 wrote to memory of 1740 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1740 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1740 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1740 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1772 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1772 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1772 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 1772 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 860 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 860 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 860 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe PID 1292 wrote to memory of 860 1292 SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 852 taskkill.exe Token: SeDebugPrivilege 1408 taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM svmm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM svm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"2⤵
- Deletes itself
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c RMDIR /S /Q "C:\Program Files (x86)\svm"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"2⤵