Analysis
- max time kernel
133s - max time network
143s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe
- Size 196KB
- Sample201109-fd2qqfp6k6
- SHA256 983d5da5a77bd35296ad8569ec9eeeb0b7984f9deadf4d7b65842275da53ca72
- MD5 f10fa882881f9083f8184209142842f3
- SHA1 c1eaf9dfd4111bc0498d213cfbc90ee5d9e483a4
- SHA512 3c3004d9d1588b92f766c0c304e5cbd3d63921c161cf6a053adde164df1e2ba5fd3d27068f3976d72912f8d04fc0c4c7e83ea5d4d02ef722adb7de2861aab81d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Ostersin\\gennt.exe\"" gennt.exe - ServiceHost packer 5 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3644-11-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3644-10-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3644-12-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3644-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3644-14-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 1 IoCs
pid Process 692 gennt.exe - Deletes itself 1 IoCs
pid Process 692 gennt.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\F: gennt.exe File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\M: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\K: gennt.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2792 3644 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 692 gennt.exe 692 gennt.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe 2792 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2792 WerFault.exe Token: SeBackupPrivilege 2792 WerFault.exe Token: SeDebugPrivilege 2792 WerFault.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 984 wrote to memory of 692 984 SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe 75 PID 984 wrote to memory of 692 984 SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe 75 PID 984 wrote to memory of 692 984 SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe 75 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78 PID 692 wrote to memory of 3644 692 gennt.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\ProgramData\Ostersin\gennt.exeC:\ProgramData\Ostersin\gennt.exe "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.f10fa882881f9083.11555.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\Ostersin\gennt.exe3⤵PID:3644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 3404⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
-