Analysis
- max time kernel
144s - max time network
138s - platform
windows10_x64 - resource
win10v200722 - submitted
25/08/2020, 23:20
General
- Target SecuriteInfo.com.Trojan.Malware.300983.susgen.6104.exe
- Size 580KB
- Sample200825-ccfg8v9912
- SHA256 ba88c5da9e0da61bb89e40c58e85d2f5c049613dae5d5b7cc847558ca8e84aac
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.6104.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.6104.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 416 -s 18722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.6104.exeC:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.6104.exe {61CD4279-0031-4155-8AF4-4999F16D2D21}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/416-0-0x00000000022C0000-0x00000000022F0000-memory.dmp
memory/1472-1-0x00000000021A0000-0x00000000021D0000-memory.dmp
memory/1896-2-0x0000013885560000-0x0000013885561000-memory.dmp
memory/1896-3-0x00000138863D0000-0x00000138863D1000-memory.dmp
memory/1896-4-0x00000138863D0000-0x00000138863D1000-memory.dmp