SecuriteInfo.com.Linux.Siggen.3357.22805.30916

General
Target

SecuriteInfo.com.Linux.Siggen.3357.22805.30916

Filesize

437KB

Completed

21-11-2020 16:58

Score
1 /10
MD5

696e284146f1578e1b9150e621e4a8db

SHA1

42dec20164c5759f6e433086d10dec4bae21000c

SHA256

0f6a70f57aa95cfbbd7e4d5a88cf3bc4f6b02a104e316dbfee95525da57bd1ab

Malware Config
Signatures 3

Filter: none

  • Modifies registry class
    rundll32.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_Classes\Local Settingsrundll32.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCacherundll32.exe
  • Suspicious behavior: GetForegroundWindowSpam
    rundll32.exe

    Reported IOCs

    pidprocess
    1976rundll32.exe
  • Suspicious use of WriteProcessMemory
    cmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 784 wrote to memory of 1976784cmd.exerundll32.exe
    PID 784 wrote to memory of 1976784cmd.exerundll32.exe
    PID 784 wrote to memory of 1976784cmd.exerundll32.exe
Processes 2
  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Linux.Siggen.3357.22805.30916
    Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Linux.Siggen.3357.22805.30916
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      PID:1976
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/1976-0-0x0000000000000000-mapping.dmp

                            Download