Overview

overview

5

Static

static

SecuriteIn...09.exe

windows7_x64

5

SecuriteIn...09.exe

windows10_x64

5

Analysis

  • max time kernel
    143s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    10-07-2020 21:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe

  • Size

    21KB

  • MD5

    5df538e080dbe410f614180e895fa655

  • SHA1

    16bb74276eaf9695091befb5f1559893eb10e84e

  • SHA256

    62824d9a353a539053724252d3710008e5894f3580fec8449ec38b7828e7b389

  • SHA512

    fba134ab40cc2de9c27af6d902b27eda6a88bf3caceba53442c36e533197de8d972e4f65b6c954e59fc8990a5047df01496ea8e73573d06afd9139ef31516cf7

Score
5/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 52 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    PID:1296
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
      2⤵
        PID:1600
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        2⤵
          PID:304
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
          2⤵
            PID:800
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            2⤵
              PID:548
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious use of AdjustPrivilegeToken
              PID:748
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C taskkill /F /PID 748 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1796
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /PID 748
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1840
                • C:\Windows\SysWOW64\choice.exe
                  choice /C Y /N /D Y /T 3
                  4⤵
                    PID:268

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/268-6-0x0000000000000000-mapping.dmp
              Download
            • memory/748-0-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

              Download
            • memory/748-1-0x0000000000426DCE-mapping.dmp
              Download
            • memory/748-2-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

              Download
            • memory/748-3-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

              Download
            • memory/1796-4-0x0000000000000000-mapping.dmp
              Download
            • memory/1840-5-0x0000000000000000-mapping.dmp
              Download