Analysis
-
max time kernel
14s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:35
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe
-
Size
2.0MB
-
MD5
a73541d475c3241cc6da0efe02a81bf9
-
SHA1
c0a0767ae30a41e4286f6bb13e6700c37edeac91
-
SHA256
1659c9d1ae30e74fbc99b4a2f6928ea3de4f597efb3d90efa0e6829c3c5ad089
-
SHA512
8017c48d832152f89b44c22273bcc79c6d7ea7a6563f67626e30d67f2c449e4e7d5b4a492742235203377c07ab91e82ffcee50442528d85c39adda89d539a31a
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exeSecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exepid process 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe 1748 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe 1748 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.execmd.exedescription pid process target process PID 1808 wrote to memory of 1748 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe PID 1808 wrote to memory of 1748 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe PID 1808 wrote to memory of 1748 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe PID 1808 wrote to memory of 1748 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe PID 1808 wrote to memory of 1508 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe cmd.exe PID 1808 wrote to memory of 1508 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe cmd.exe PID 1808 wrote to memory of 1508 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe cmd.exe PID 1808 wrote to memory of 1508 1808 SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe cmd.exe PID 1508 wrote to memory of 676 1508 cmd.exe PING.EXE PID 1508 wrote to memory of 676 1508 cmd.exe PING.EXE PID 1508 wrote to memory of 676 1508 cmd.exe PING.EXE PID 1508 wrote to memory of 676 1508 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.31393.28280.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe