8215972987c85e180e7df1a17bac6575df92fe882d0092bf470d2ce651db2585

Resubmissions

07-07-2022 09:57

220707-lywzqsbhhq 10

08-07-2020 13:11

200708-sld1v8j6w2 7

Analysis

max time kernel
147s
max time network
28s
platform
windows7_x64
resource
win7v200430
submitted
08-07-2020 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
Size

84KB
MD5

a4e39f608731d31fbcc17d98a3ec8508
SHA1

6f36f07b4e5efbf35b4b1f7916a7047db9b49535
SHA256

8215972987c85e180e7df1a17bac6575df92fe882d0092bf470d2ce651db2585
SHA512

673b10d5e3740f1d5585e5c647006b81dbf784f67655c684ae982bd87e21b8f98ef3631c197e9b8e18fcf3c453a267942e3d2dd5f0f01b9670cb38c9f1932aee

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1740 cmd.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

852 taskkill.exe
1408 taskkill.exe

pid	process
1740	cmd.exe

pid	process
852	taskkill.exe
1408	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe

pid	process
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe

description	pid	process	target process
PID 1292 wrote to memory of 852	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 852	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 852	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 852	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 1408	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 1408	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 1408	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 1408	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	taskkill.exe
PID 1292 wrote to memory of 1740	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1740	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1740	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1740	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1772	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1772	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1772	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 1772	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 860	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 860	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 860	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe
PID 1292 wrote to memory of 860	1292	SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

taskkill.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 852 taskkill.exe
Token: SeDebugPrivilege 1408 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM svmm.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM svm.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
2⤵
- Deletes itself
PID:1740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c RMDIR /S /Q "C:\Program Files (x86)\svm"
2⤵
PID:1772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
2⤵
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-0-0x0000000000000000-mapping.dmp

Download
memory/860-4-0x0000000000000000-mapping.dmp

Download
memory/1408-1-0x0000000000000000-mapping.dmp

Download
memory/1740-2-0x0000000000000000-mapping.dmp

Download
memory/1772-3-0x0000000000000000-mapping.dmp

Download