Analysis
- max time kernel
149s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
22/07/2020, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe
- Size 27KB
- Sample200722-j66symd1vs
- SHA256 cdb2b4c85d67ee5d29410f0411776be88c42a21df4c153b831db9562f7a5f8da
- MD5 354bb8a5ccd3d21cdecdf379bb2be20f
- SHA1 ca578f79ed20ec2b6a9fb77dbfce76f49a3ed400
- SHA512 4ba184804ccf4cf9b28fe161b43fba97459286c67656d6d9886d8c8511402189185ed1dc4c47ff9e27ab5acbe64c9f13e0525b0e2733f1e7d7baa6ef36470f2d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3676 wrote to memory of 1892 3676 SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe 67 PID 3676 wrote to memory of 1892 3676 SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe 67 PID 3676 wrote to memory of 1892 3676 SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe 67 PID 1892 wrote to memory of 3856 1892 svchost.exe 68 PID 1892 wrote to memory of 3856 1892 svchost.exe 68 PID 1892 wrote to memory of 3856 1892 svchost.exe 68 PID 1892 wrote to memory of 3868 1892 svchost.exe 69 PID 1892 wrote to memory of 3868 1892 svchost.exe 69 PID 1892 wrote to memory of 3868 1892 svchost.exe 69 PID 1892 wrote to memory of 3992 1892 svchost.exe 70 PID 1892 wrote to memory of 3992 1892 svchost.exe 70 PID 1892 wrote to memory of 3992 1892 svchost.exe 70 PID 3856 wrote to memory of 1840 3856 2647931854.exe 71 PID 3856 wrote to memory of 1840 3856 2647931854.exe 71 PID 3856 wrote to memory of 1840 3856 2647931854.exe 71 PID 1840 wrote to memory of 736 1840 svchost.exe 72 PID 1840 wrote to memory of 736 1840 svchost.exe 72 PID 1840 wrote to memory of 736 1840 svchost.exe 72 PID 1840 wrote to memory of 3260 1840 svchost.exe 73 PID 1840 wrote to memory of 3260 1840 svchost.exe 73 PID 1840 wrote to memory of 3260 1840 svchost.exe 73 PID 1840 wrote to memory of 3684 1840 svchost.exe 74 PID 1840 wrote to memory of 3684 1840 svchost.exe 74 PID 1840 wrote to memory of 3684 1840 svchost.exe 74 - Executes dropped EXE 8 IoCs
pid Process 1892 svchost.exe 3856 2647931854.exe 3868 2798611650.exe 3992 1864019701.exe 1840 svchost.exe 736 1221215762.exe 3260 2448124896.exe 3684 2053034999.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" svchost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2354599216742\\svchost.exe" SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2354599216742\\svchost.exe" SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\29347192371515\\svchost.exe" 2647931854.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\29347192371515\\svchost.exe" 2647931854.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_YQkDRA.5848.32110.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
PID:3676 -
C:\2354599216742\svchost.exeC:\2354599216742\svchost.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Windows security modification
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2647931854.exeC:\Users\Admin\AppData\Local\Temp\2647931854.exe3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Adds Run key to start application
PID:3856 -
C:\29347192371515\svchost.exeC:\29347192371515\svchost.exe4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Windows security modification
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1221215762.exeC:\Users\Admin\AppData\Local\Temp\1221215762.exe5⤵
- Executes dropped EXE
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\2448124896.exeC:\Users\Admin\AppData\Local\Temp\2448124896.exe5⤵
- Executes dropped EXE
PID:3260
-
-
C:\Users\Admin\AppData\Local\Temp\2053034999.exeC:\Users\Admin\AppData\Local\Temp\2053034999.exe5⤵
- Executes dropped EXE
PID:3684
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2798611650.exeC:\Users\Admin\AppData\Local\Temp\2798611650.exe3⤵
- Executes dropped EXE
PID:3868
-
-
C:\Users\Admin\AppData\Local\Temp\1864019701.exeC:\Users\Admin\AppData\Local\Temp\1864019701.exe3⤵
- Executes dropped EXE
PID:3992
-
-