0f6166d9b707f8610c81b7068962611e25cdef8db665b10343179d82131ef0a3

General

Target

SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe
Size

110KB
MD5

3af1d421410a6e528c93384a25437956
SHA1

db52c58a5791865071b17ec7403b8ac9bb9abb66
SHA256

0f6166d9b707f8610c81b7068962611e25cdef8db665b10343179d82131ef0a3
SHA512

7aa68ef3f9d4b4a5e38a04c35aef1579b95cc3f0d221e900cf59564e9366fc19aacc0896d7034c6b084234614b8810782b5cb99be07396cc1179b960a4f5e3a9

Score

9^/10

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exenet.exe

description	pid	process	target process
PID 3480 wrote to memory of 2484	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	net.exe
PID 3480 wrote to memory of 2484	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	net.exe
PID 3480 wrote to memory of 2484	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	net.exe
PID 2484 wrote to memory of 648	2484	net.exe	net1.exe
PID 2484 wrote to memory of 648	2484	net.exe	net1.exe
PID 2484 wrote to memory of 648	2484	net.exe	net1.exe
PID 3480 wrote to memory of 808	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	powershell.exe
PID 3480 wrote to memory of 808	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	powershell.exe
PID 3480 wrote to memory of 808	3480	SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1156 808 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1156 WerFault.exe
Token: SeBackupPrivilege 1156 WerFault.exe
Token: SeDebugPrivilege 1156 WerFault.exe

pid	pid_target	process	target process
1156	808	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

ServiceHost packer 6 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/808-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/808-5-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/808-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/808-8-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/808-7-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/808-9-0x0000000000000000-mapping.dmp	servicehost

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\net.exe
"net" stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
PID:808

memory/648-1-0x0000000000000000-mapping.dmp

Download
memory/808-2-0x0000000000000000-mapping.dmp

Download
memory/808-4-0x0000000000000000-mapping.dmp

Download
memory/808-5-0x0000000000000000-mapping.dmp

Download
memory/808-6-0x0000000000000000-mapping.dmp

Download
memory/808-8-0x0000000000000000-mapping.dmp

Download
memory/808-7-0x0000000000000000-mapping.dmp

Download
memory/808-9-0x0000000000000000-mapping.dmp

Download
memory/1156-3-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/1156-10-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/2484-0-0x0000000000000000-mapping.dmp

Download