Analysis
- max time kernel
21s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
16/12/2020, 19:43
General
- Target SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe
- Size 20KB
- Sample201216-a5ntsvc9mn
- SHA256 3c33ca69721ea834bbcde665ef950aa66c77b237784cce98173d97315be08d17
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.105.30936.26237.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.1042⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.1043⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 20082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/208-14-0x0000000004430000-0x0000000004431000-memory.dmp
memory/208-15-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/576-2-0x0000000073560000-0x0000000073C4E000-memory.dmp
memory/576-3-0x0000000000200000-0x0000000000201000-memory.dmp
memory/576-5-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/576-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/576-7-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/576-8-0x0000000002510000-0x0000000002511000-memory.dmp