Analysis
- max time kernel
149s - max time network
115s - platform
windows10_x64 - resource
win10v200722 - submitted
25/08/2020, 23:20
General
- Target SecuriteInfo.com.Trojan.Malware.300983.susgen.3284.exe
- Size 580KB
- Sample200825-2a8kwfd5j6
- SHA256 a1ffd297c0c7ee67f9d699290b28c2191e4b6b7fba34fbe828459a50ea6abd21
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.3284.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.3284.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 412 -s 19402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.3284.exeC:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.3284.exe {9DB9EEFE-B08D-4151-BF96-39FC04D89666}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/412-0-0x0000000002290000-0x00000000022C0000-memory.dmp
memory/1564-1-0x0000000000500000-0x0000000000530000-memory.dmp
memory/2116-2-0x00000165FD890000-0x00000165FD891000-memory.dmp
memory/2116-3-0x00000165FE700000-0x00000165FE701000-memory.dmp
memory/2116-4-0x00000165FE700000-0x00000165FE701000-memory.dmp