Analysis
- max time kernel
14s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:34
General
- Target SecuriteInfo.com.Variant.MSILPerseus.225130.19779.32471.exe
- Size 259KB
- Sample201109-gpaa33gr3j
- SHA256 d7c429cf20f1e4532daae7b1da6bbd89cc286d2cddab72a384bb3d6403f8ac2a
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.19779.32471.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.19779.32471.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.19779.32471.exe"{path}"2⤵
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2556-24-0x00000000088C0000-0x00000000088C1000-memory.dmp
memory/2556-23-0x0000000007800000-0x0000000007801000-memory.dmp
memory/2556-39-0x0000000009970000-0x0000000009971000-memory.dmp
memory/2556-37-0x0000000009990000-0x0000000009991000-memory.dmp
memory/2556-18-0x0000000007820000-0x0000000007821000-memory.dmp
memory/2556-36-0x0000000009A30000-0x0000000009A31000-memory.dmp
memory/2556-35-0x0000000009870000-0x0000000009871000-memory.dmp
memory/2556-17-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/2556-27-0x00000000094B0000-0x00000000094E3000-memory.dmp
memory/2556-25-0x0000000008690000-0x0000000008691000-memory.dmp
memory/2556-16-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/2556-22-0x0000000008130000-0x0000000008131000-memory.dmp
memory/2556-34-0x0000000009490000-0x0000000009491000-memory.dmp
memory/2556-21-0x0000000008030000-0x0000000008031000-memory.dmp
memory/2556-19-0x0000000007670000-0x0000000007671000-memory.dmp
memory/2556-20-0x0000000007710000-0x0000000007711000-memory.dmp
memory/2588-12-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/2588-9-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3980-6-0x000000000A000000-0x000000000A002000-memory.dmp
memory/3980-3-0x00000000081A0000-0x00000000081A1000-memory.dmp
memory/3980-0-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/3980-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/3980-8-0x000000000B850000-0x000000000B851000-memory.dmp
memory/3980-7-0x000000000B790000-0x000000000B79B000-memory.dmp
memory/3980-5-0x0000000007D30000-0x0000000007D31000-memory.dmp
memory/3980-4-0x0000000007D40000-0x0000000007D41000-memory.dmp