82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639

Analysis

Target
SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe
Size 870KB
Sample201109-ejyca2wzkx
SHA256 82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639
MD5 145dc1bfd96fb13644e764d0032e6c4e
SHA1 15652c5110b51eeab7d023d75a4337de84ef7528
SHA512 a7bd3ffc57c05dab54672f344708478fd4af2635cdedacc8779b55e01ffb6f21cfdcaf7b676269c3ca53f28267c83f48db6e943291f176dcd89e4cc97b4456c6
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2932	dw20.exe
2932	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2932	dw20.exe
Token: SeBackupPrivilege	2932	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2932	580	SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe	75
PID 580 wrote to memory of 2932	580	SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe	75
PID 580 wrote to memory of 2932	580	SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe	75

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1532
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932

memory/2932-4-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/2932-5-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/2932-7-0x0000000003090000-0x0000000003091000-memory.dmp

Download