Analysis
-
max time kernel
53s -
max time network
54s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 13:09
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe
-
Size
651KB
-
MD5
d0b73f883fdd6cc9097028375fdc6231
-
SHA1
786826282e4f20076f50b7648e45ca1df856dd12
-
SHA256
97c1693cc21829a1b2139d13bc9b21a47555b18d6dc8943c4804890f1ab3b25c
-
SHA512
6c76cacd033b503d54d260f69ba370117f46c0b2fd72f6e9851e73d17d6966ffd1bceb655b3df029a5661275a14702c0b1d6094aac12480291199f963235c91c
Malware Config
Extracted
remcos
push4me.freeddns.org:1814
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rtemcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\eremcos\\VLC.exe\"" SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe -
Suspicious use of WriteProcessMemory 68 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exeSecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exedescription pid process target process PID 1096 wrote to memory of 1988 1096 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1096 wrote to memory of 1988 1096 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1096 wrote to memory of 1988 1096 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1096 wrote to memory of 1988 1096 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1988 wrote to memory of 1976 1988 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1988 wrote to memory of 1976 1988 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1988 wrote to memory of 1976 1988 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1988 wrote to memory of 1976 1988 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1976 wrote to memory of 1768 1976 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1976 wrote to memory of 1768 1976 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1976 wrote to memory of 1768 1976 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1976 wrote to memory of 1768 1976 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1768 wrote to memory of 1384 1768 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1768 wrote to memory of 1384 1768 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1768 wrote to memory of 1384 1768 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1768 wrote to memory of 1384 1768 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1384 wrote to memory of 1584 1384 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1384 wrote to memory of 1584 1384 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1384 wrote to memory of 1584 1384 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1384 wrote to memory of 1584 1384 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1584 wrote to memory of 1560 1584 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1584 wrote to memory of 1560 1584 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1584 wrote to memory of 1560 1584 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1584 wrote to memory of 1560 1584 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1560 wrote to memory of 1748 1560 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1560 wrote to memory of 1748 1560 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1560 wrote to memory of 1748 1560 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1560 wrote to memory of 1748 1560 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1748 wrote to memory of 752 1748 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1748 wrote to memory of 752 1748 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1748 wrote to memory of 752 1748 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1748 wrote to memory of 752 1748 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 752 wrote to memory of 1796 752 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 752 wrote to memory of 1796 752 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 752 wrote to memory of 1796 752 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 752 wrote to memory of 1796 752 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1796 wrote to memory of 396 1796 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1796 wrote to memory of 396 1796 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1796 wrote to memory of 396 1796 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1796 wrote to memory of 396 1796 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 396 wrote to memory of 1456 396 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 396 wrote to memory of 1456 396 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 396 wrote to memory of 1456 396 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 396 wrote to memory of 1456 396 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1456 wrote to memory of 576 1456 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1456 wrote to memory of 576 1456 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1456 wrote to memory of 576 1456 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1456 wrote to memory of 576 1456 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 576 wrote to memory of 292 576 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 576 wrote to memory of 292 576 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 576 wrote to memory of 292 576 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 576 wrote to memory of 292 576 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 292 wrote to memory of 932 292 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 292 wrote to memory of 932 292 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 292 wrote to memory of 932 292 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 292 wrote to memory of 932 292 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 932 wrote to memory of 1156 932 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 932 wrote to memory of 1156 932 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 932 wrote to memory of 1156 932 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 932 wrote to memory of 1156 932 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe PID 1156 wrote to memory of 1872 1156 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe WScript.exe PID 1156 wrote to memory of 1872 1156 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe WScript.exe PID 1156 wrote to memory of 1872 1156 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe WScript.exe PID 1156 wrote to memory of 1872 1156 SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.58832.24978.21590.exe"16⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\eremcos\VLC.exe"18⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
516c683f65edb23d0e850fa3ef3c8684
SHA12ac568ffec85d04a03ce8cd67d22c0f57ebcf78b
SHA25690fcf9d38e16bf59c8ba902a0a2fb4535cb54515fdb51ecf561cec6911db553d
SHA512fb785e0ba530ef75dab428467da6b2da078a356a953fb7b1729d2474b06a44f854cfd41fa6f3432e13f330c4a12b1665d316c63291fbd46bb165ba1e7b384c93
-
memory/292-27-0x0000000000000000-mapping.dmp
-
memory/396-21-0x0000000000000000-mapping.dmp
-
memory/576-25-0x0000000000000000-mapping.dmp
-
memory/752-17-0x0000000000000000-mapping.dmp
-
memory/932-29-0x0000000000000000-mapping.dmp
-
memory/1096-2-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1156-31-0x0000000000000000-mapping.dmp
-
memory/1156-33-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1156-35-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1384-9-0x0000000000000000-mapping.dmp
-
memory/1456-23-0x0000000000000000-mapping.dmp
-
memory/1540-38-0x0000000000000000-mapping.dmp
-
memory/1560-13-0x0000000000000000-mapping.dmp
-
memory/1584-11-0x0000000000000000-mapping.dmp
-
memory/1748-15-0x0000000000000000-mapping.dmp
-
memory/1768-7-0x0000000000000000-mapping.dmp
-
memory/1796-19-0x0000000000000000-mapping.dmp
-
memory/1872-34-0x0000000000000000-mapping.dmp
-
memory/1872-39-0x0000000002880000-0x0000000002884000-memory.dmpFilesize
16KB
-
memory/1976-5-0x0000000000000000-mapping.dmp
-
memory/1988-3-0x0000000000000000-mapping.dmp