d85623e40ad2ce2710913d1033fc78e3c0c7151837f4af41bf592ceb5bf68cdf

General

Target

SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe
Size

115KB
MD5

2d96d4b232edab88dd7bf3ab0e87f5f0
SHA1

7979259ca944d83302caa738fc01f460b31e8d85
SHA256

d85623e40ad2ce2710913d1033fc78e3c0c7151837f4af41bf592ceb5bf68cdf
SHA512

5caf735b63dba73089268a9887148cee5cd1584128298e049425ffbdf52138d75b93298ae388dbd935d3d7f39a1e9238757d9cab7ab150a72000e9a2a56009ac

Score

8^/10

evasion persistence

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

System.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\301b5fcf8ce2fab8868e80b6c1f912fe.exe	System.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\301b5fcf8ce2fab8868e80b6c1f912fe.exe	System.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exeSystem.exe

description	pid	process	target process
PID 3856 wrote to memory of 2892	3856	SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe	System.exe
PID 3856 wrote to memory of 2892	3856	SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe	System.exe
PID 3856 wrote to memory of 2892	3856	SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe	System.exe
PID 2892 wrote to memory of 3616	2892	System.exe	netsh.exe
PID 2892 wrote to memory of 3616	2892	System.exe	netsh.exe
PID 2892 wrote to memory of 3616	2892	System.exe	netsh.exe

Executes dropped EXE 1 IoCs

Processes:

System.exe

pid process

2892 System.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

System.exe

description pid process

Token: SeDebugPrivilege 2892 System.exe

description	pid	process
Token: SeDebugPrivilege	2892	System.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

System.exe

pid	process
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe
2892	System.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

System.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\301b5fcf8ce2fab8868e80b6c1f912fe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\301b5fcf8ce2fab8868e80b6c1f912fe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .."	System.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader33.36721.26238.29912.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:2892

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System.exe" "System.exe" ENABLE
3⤵
PID:3616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Download Submit
memory/2892-0-0x0000000000000000-mapping.dmp

Download
memory/3616-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads