Analysis
- max time kernel
117s - max time network
120s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:19
General
- Target SecuriteInfo.com.Program.Unwanted.3148.26529.13687.exe
- Size 4.6MB
- Sample201109-ep9kfgrf5a
- SHA256 ce7fab69a6c10146ac89e121fbe204ca424cd886c4763674eb2e9260b2f6b722
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Loads dropped DLL 23 IoCs
- Checks for any installed AV software in registry 1 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.3148.26529.13687.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.3148.26529.13687.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83448C84\installer.exe.\installer.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83448C84\GenericSetup.exe"C:\Users\Admin\AppData\Local\Temp\7zS83448C84\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS83448C84\GenericSetup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3508-84-0x0000000006BF0000-0x0000000006BF1000-memory.dmp
memory/3508-67-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/3508-77-0x00000000060E0000-0x00000000060E1000-memory.dmp
memory/3508-78-0x0000000006160000-0x0000000006161000-memory.dmp
memory/3508-79-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
memory/3508-59-0x0000000005960000-0x0000000005961000-memory.dmp
memory/3508-55-0x0000000005570000-0x0000000005571000-memory.dmp
memory/3508-82-0x0000000006B30000-0x0000000006B31000-memory.dmp
memory/3508-71-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3508-63-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/3508-51-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/3508-87-0x000000000A680000-0x000000000A681000-memory.dmp
memory/3508-47-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/3508-46-0x0000000071FA0000-0x000000007268E000-memory.dmp
memory/3508-91-0x000000000A6B0000-0x000000000A6B1000-memory.dmp
memory/3508-96-0x000000000D760000-0x000000000D761000-memory.dmp
memory/3508-74-0x0000000005D00000-0x0000000005D01000-memory.dmp