Overview

overview

7

Static

static

SecuriteIn...66.exe

windows7_x64

7

SecuriteIn...66.exe

windows10_x64

1

Resubmissions

07-07-2022 09:57

220707-lywzqsbhhq 10

08-07-2020 13:11

200708-sld1v8j6w2 7

Analysis

  • max time kernel
    147s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    08-07-2020 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe

  • Size

    84KB

  • MD5

    a4e39f608731d31fbcc17d98a3ec8508

  • SHA1

    6f36f07b4e5efbf35b4b1f7916a7047db9b49535

  • SHA256

    8215972987c85e180e7df1a17bac6575df92fe882d0092bf470d2ce651db2585

  • SHA512

    673b10d5e3740f1d5585e5c647006b81dbf784f67655c684ae982bd87e21b8f98ef3631c197e9b8e18fcf3c453a267942e3d2dd5f0f01b9670cb38c9f1932aee

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM svmm.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:852
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM svm.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
      2⤵
      • Deletes itself
      PID:1740
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c RMDIR /S /Q "C:\Program Files (x86)\svm"
      2⤵
        PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.10163.566.exe"
        2⤵
          PID:860

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/852-0-0x0000000000000000-mapping.dmp

        Download

      • memory/860-4-0x0000000000000000-mapping.dmp

        Download

      • memory/1408-1-0x0000000000000000-mapping.dmp

        Download

      • memory/1740-2-0x0000000000000000-mapping.dmp

        Download

      • memory/1772-3-0x0000000000000000-mapping.dmp

        Download