Analysis

  • max time kernel
    130s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    25/08/2020, 23:19

General

  • Target
    SecuriteInfo.com.Trojan.Malware.300983.susgen.9221.exe
  • Size 580KB
  • Sample200825-cemsl5mya2
  • SHA256 3db0ffdac23433607c69a18ed4a3371a4b174672ca5d6424f7b50efa6f29d969
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 846 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.9221.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Malware.300983.susgen.9221.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:1004
  • C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.9221.exe
    C:\Users\Admin\AppData\Local\Temp\securiteinfo.com.trojan.malware.300983.susgen.9221.exe {C3EFED59-4A52-442E-A4B1-5DB7702D9048}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3412

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1004-2-0x00007FF6E8BF0000-0x00007FF6E8C33000-memory.dmp

        memory/1004-4-0x00007FF6E8BF0000-0x00007FF6E8C33000-memory.dmp

        memory/3412-1-0x00000000021B0000-0x00000000021E0000-memory.dmp

        memory/3608-0-0x00000000022A0000-0x00000000022D0000-memory.dmp