Overview

overview

6

Static

static

SecuriteIn...81.exe

windows7_x64

6

SecuriteIn...81.exe

windows10_x64

6

Analysis

  • max time kernel
    136s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    01-08-2020 19:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Inject2.57861.24408.7581.exe

  • Size

    63KB

  • MD5

    49b71eb3c4e9b9f5f4d58722e6bcdfa4

  • SHA1

    519870c71a1ae3c12300284139d1e311e16ea416

  • SHA256

    8179d0b5e1307621aa793c502a89ac3b7aba833f3b4fc815f99d0dbc85aa7c06

  • SHA512

    8303a45003605f4c1dc7b7ca182f526eb0897c3e43d5118c448b94cc3f25e4e32b13b4722165e4c7cc72e14d0cdf9fd3612656919bc50febf4e0574454235acb

Score
6/10
persistence

Malware Config

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject2.57861.24408.7581.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject2.57861.24408.7581.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Adds Run key to start application
    PID:608
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\system32\explorer.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/316-0-0x0000000000080000-0x0000000000093000-memory.dmp
    Filesize

    76KB

    Download
  • memory/316-1-0x0000000000083BF0-mapping.dmp
    Download