e0eacfa4cf09057f4392c8f5ee42ad8cb23ac9e63b259ea4907e1966a01ece56 | Triage

Analysis

max time kernel
151s
max time network
144s
platform
windows7_x64
resource
win7
submitted
01-08-2020 19:31

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe
Size

25KB
MD5

808849de500179ec0fbc82c862f62333
SHA1

f6319f4f42a5406355ba7727a9f2f1937fbac159
SHA256

e0eacfa4cf09057f4392c8f5ee42ad8cb23ac9e63b259ea4907e1966a01ece56
SHA512

e85833a268f34c2bdbc9b83260754c844600fbbe15b577a43caa4c89f74ac25c50d139f77d650bdfac78b12ba424ec3482212bfb4084c32db64e6e4ebb29a063

Score

7^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe

pid process

1684 SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe
1684 SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe

Drops startup file 1 IoCs

Processes:

SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winup.lnk	SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader33.60708.6200.15325.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000002C30000-0x0000000002C41000-memory.dmp

Filesize
68KB

Download
memory/1684-1-0x0000000003040000-0x0000000003051000-memory.dmp

Filesize
68KB

Download
memory/1684-2-0x0000000002C30000-0x0000000002C41000-memory.dmp

Filesize
68KB

Download