Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    25/08/2020, 23:20

General

  • Target
    SecuriteInfo.com.Trojan.Malware.300983.susgen.26246.exe
  • Size 580KB
  • Sample200825-avss4av48j
  • SHA256 f9bd0436e92443e755484de96679dfd4f2849af8b95285f818e283aa700cefad
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 846 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.26246.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.26246.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:3432
  • C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.26246.exe
    C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.26246.exe {D88291D6-DE7A-4584-B3FA-9EF04AEA4077}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3884

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2920-0-0x00000000020A0000-0x00000000020D0000-memory.dmp

        memory/3432-2-0x00007FF7BF7E0000-0x00007FF7BF823000-memory.dmp

        memory/3432-4-0x00007FF7BF7E0000-0x00007FF7BF823000-memory.dmp

        memory/3884-1-0x00000000005F0000-0x0000000000620000-memory.dmp