9b31f62eba51d6306c43c073911e03f80805f363683acc38ac31511a234c3f8d

General

Target

SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
Size

2.0MB
MD5

06fc098e9bee239ad5bb817d3ef30185
SHA1

109f83114e59109f3ae30367776d10513a473c2d
SHA256

9b31f62eba51d6306c43c073911e03f80805f363683acc38ac31511a234c3f8d
SHA512

21b4cd83c6798836bc041794ea7a15f24194a34b7e30293ff9c66a0c04291a0d7c165f9ee02dd5a2bd03486f6e8a3ba98b0fb2afd40585b2e6ad9b66ca4764ec

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1504 PING.EXE

pid	process
1504	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exeSecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe

pid	process
336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
1668	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
1668	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.execmd.exe

description	pid	process	target process
PID 336 wrote to memory of 1668	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
PID 336 wrote to memory of 1668	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
PID 336 wrote to memory of 1668	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
PID 336 wrote to memory of 1668	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
PID 336 wrote to memory of 1284	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	cmd.exe
PID 336 wrote to memory of 1284	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	cmd.exe
PID 336 wrote to memory of 1284	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	cmd.exe
PID 336 wrote to memory of 1284	336	SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe	cmd.exe
PID 1284 wrote to memory of 1504	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1504	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1504	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1504	1284	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39574.10161.4629.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1504

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-2-0x0000000000000000-mapping.dmp

Download
memory/1504-3-0x0000000000000000-mapping.dmp

Download
memory/1668-0-0x0000000000000000-mapping.dmp

Download
memory/1668-1-0x0000000002430000-0x0000000002441000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing