62824d9a353a539053724252d3710008e5894f3580fec8449ec38b7828e7b389

General

Target

SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe
Size

21KB
MD5

5df538e080dbe410f614180e895fa655
SHA1

16bb74276eaf9695091befb5f1559893eb10e84e
SHA256

62824d9a353a539053724252d3710008e5894f3580fec8449ec38b7828e7b389
SHA512

fba134ab40cc2de9c27af6d902b27eda6a88bf3caceba53442c36e533197de8d972e4f65b6c954e59fc8990a5047df01496ea8e73573d06afd9139ef31516cf7

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exeAddInProcess32.execmd.exe

description	pid	process	target process
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3448	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3044 wrote to memory of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe
PID 3872 wrote to memory of 3932	3872	AddInProcess32.exe	cmd.exe
PID 3872 wrote to memory of 3932	3872	AddInProcess32.exe	cmd.exe
PID 3872 wrote to memory of 3932	3872	AddInProcess32.exe	cmd.exe
PID 3932 wrote to memory of 3500	3932	cmd.exe	taskkill.exe
PID 3932 wrote to memory of 3500	3932	cmd.exe	taskkill.exe
PID 3932 wrote to memory of 3500	3932	cmd.exe	taskkill.exe
PID 3932 wrote to memory of 1940	3932	cmd.exe	choice.exe
PID 3932 wrote to memory of 1940	3932	cmd.exe	choice.exe
PID 3932 wrote to memory of 1940	3932	cmd.exe	choice.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe

description pid process target process

PID 3044 set thread context of 3872 3044 SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe AddInProcess32.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3500 taskkill.exe

description	pid	process	target process
PID 3044 set thread context of 3872	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe	AddInProcess32.exe

pid	process
3500	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exeAddInProcess32.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	3044	SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe
Token: SeDebugPrivilege	3872	AddInProcess32.exe
Token: SeDebugPrivilege	3500	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
2⤵
PID:3448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 3872 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 3872
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-4-0x0000000000000000-mapping.dmp

Download
memory/3500-3-0x0000000000000000-mapping.dmp

Download
memory/3872-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3872-1-0x0000000000426DCE-mapping.dmp

Download
memory/3932-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing