Analysis
- max time kernel
11s - max time network
16s - platform
windows7_x64 - resource
win7v20201028 - submitted
16/12/2020, 19:43
General
- Target SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe
- Size 20KB
- Sample201216-a5ntsvc9mn
- SHA256 3c33ca69721ea834bbcde665ef950aa66c77b237784cce98173d97315be08d17
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.1042⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.1043⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 17202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-8-0x0000000001E60000-0x0000000001E71000-memory.dmp
memory/396-9-0x00000000027E0000-0x00000000027F1000-memory.dmp
memory/1408-2-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/1408-3-0x0000000000E90000-0x0000000000E91000-memory.dmp