Analysis
-
max time kernel
98s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe
-
Size
36KB
-
MD5
d64ae064a4fc5d008723a2d092d232e5
-
SHA1
de033ba17f3b675d6907e154a0444e73b572f7ef
-
SHA256
6cec4d45ec32bf036c8b5a513e029a5012c799e16acef1481e41822ba20dce8a
-
SHA512
040e80fea05c97c621330d4fc423a83452a57a4c28f862e529a8259e87d58c3c153971ef17565274f7ec1385e34ada443e6f7526244dafab59a209047c0e7ec1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
admin@adipico.com - Password:
HELPMELORD@2021
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe\"" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-8-0x0000000005AA0000-0x0000000005B04000-memory.dmp family_agenttesla behavioral2/memory/3960-39-0x000000000043745E-mapping.dmp family_agenttesla behavioral2/memory/3960-36-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2532-46-0x000000000043745E-mapping.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Drops startup file 2 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe = "0" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe = "0" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exepid process 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription pid process target process PID 3888 set thread context of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 set thread context of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 set thread context of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 set thread context of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 set thread context of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4132 3820 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 4124 2816 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 4308 2816 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exepowershell.exepowershell.exeSecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exepid process 2888 powershell.exe 1224 powershell.exe 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 1176 powershell.exe 60 powershell.exe 2532 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 2532 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe 2888 powershell.exe 1176 powershell.exe 1224 powershell.exe 60 powershell.exe 2888 powershell.exe 1224 powershell.exe 60 powershell.exe 1176 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exepowershell.exepowershell.exepowershell.exepowershell.exeSecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription pid process Token: SeDebugPrivilege 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe Token: SeDebugPrivilege 2888 powershell.exe Token: SeDebugPrivilege 1224 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 60 powershell.exe Token: SeDebugPrivilege 2532 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exepid process 2532 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exedescription pid process target process PID 3888 wrote to memory of 1224 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 1224 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 1224 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 2888 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 2888 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 2888 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 1176 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 1176 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 1176 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 60 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 60 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 60 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe powershell.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3820 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2816 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 3960 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 2532 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe PID 3888 wrote to memory of 4184 3888 SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 883⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 523⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.23815.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
1e4255585f3e4cd4bdfe10a3160e10a8
SHA1e24387f33d0f9073ca2ce053f4a99d84c94b4c49
SHA256b031ff22a98d4e1424f8db2073131e29b03cae96e3d28b261253e85a012765e3
SHA51247ec60085baa332b42056ca3d9fae7e33d2f6e3ff6402f3e9ce3b86c3774913096beceba0e9de219a2c90720bb673d1ef4ce44a10828ea5f663f45cdeeeaa3f9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
1e4255585f3e4cd4bdfe10a3160e10a8
SHA1e24387f33d0f9073ca2ce053f4a99d84c94b4c49
SHA256b031ff22a98d4e1424f8db2073131e29b03cae96e3d28b261253e85a012765e3
SHA51247ec60085baa332b42056ca3d9fae7e33d2f6e3ff6402f3e9ce3b86c3774913096beceba0e9de219a2c90720bb673d1ef4ce44a10828ea5f663f45cdeeeaa3f9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
84d78c887115888cdd801aa9d95828fd
SHA16d590137706aabf4a925e0b1be06a5bc50bc5799
SHA2560497f2dae3bb62cf8b9c6224cc7f653584d473eefb8f32a8f3bc2028038fcc64
SHA512f698d00d8ec007305c259e5af535dd52fe4778ff2ee2714afa6da4f777d7d644b7da37b3e08c29b2d14e737d391087aa5bc65615c674ad18ba1b1d47867ec8fa
-
memory/60-123-0x0000000008550000-0x0000000008551000-memory.dmpFilesize
4KB
-
memory/60-52-0x0000000006E52000-0x0000000006E53000-memory.dmpFilesize
4KB
-
memory/60-83-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/60-142-0x0000000006E53000-0x0000000006E54000-memory.dmpFilesize
4KB
-
memory/60-45-0x0000000006E50000-0x0000000006E51000-memory.dmpFilesize
4KB
-
memory/60-126-0x00000000095F0000-0x00000000095F1000-memory.dmpFilesize
4KB
-
memory/60-13-0x0000000000000000-mapping.dmp
-
memory/60-93-0x00000000094C0000-0x00000000094F3000-memory.dmpFilesize
204KB
-
memory/60-21-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/60-103-0x000000007F040000-0x000000007F041000-memory.dmpFilesize
4KB
-
memory/1176-12-0x0000000000000000-mapping.dmp
-
memory/1176-19-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/1176-152-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/1176-145-0x0000000008FB0000-0x0000000008FB1000-memory.dmpFilesize
4KB
-
memory/1176-144-0x0000000006693000-0x0000000006694000-memory.dmpFilesize
4KB
-
memory/1176-79-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/1176-48-0x0000000006692000-0x0000000006693000-memory.dmpFilesize
4KB
-
memory/1176-41-0x0000000006690000-0x0000000006691000-memory.dmpFilesize
4KB
-
memory/1176-119-0x000000007E980000-0x000000007E981000-memory.dmpFilesize
4KB
-
memory/1224-10-0x0000000000000000-mapping.dmp
-
memory/1224-18-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/1224-31-0x0000000006EB0000-0x0000000006EB1000-memory.dmpFilesize
4KB
-
memory/1224-87-0x0000000008480000-0x0000000008481000-memory.dmpFilesize
4KB
-
memory/1224-141-0x0000000006EB3000-0x0000000006EB4000-memory.dmpFilesize
4KB
-
memory/1224-37-0x0000000006EB2000-0x0000000006EB3000-memory.dmpFilesize
4KB
-
memory/1224-14-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/1224-16-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/1224-114-0x000000007ED90000-0x000000007ED91000-memory.dmpFilesize
4KB
-
memory/2532-166-0x0000000002C50000-0x0000000002C51000-memory.dmpFilesize
4KB
-
memory/2532-46-0x000000000043745E-mapping.dmp
-
memory/2532-49-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/2532-167-0x00000000053F1000-0x00000000053F2000-memory.dmpFilesize
4KB
-
memory/2532-165-0x0000000006460000-0x0000000006461000-memory.dmpFilesize
4KB
-
memory/2532-139-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/2532-78-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/2816-32-0x000000000043745E-mapping.dmp
-
memory/2888-28-0x0000000007740000-0x0000000007741000-memory.dmpFilesize
4KB
-
memory/2888-34-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/2888-11-0x0000000000000000-mapping.dmp
-
memory/2888-15-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/2888-35-0x0000000007E30000-0x0000000007E31000-memory.dmpFilesize
4KB
-
memory/2888-40-0x0000000007132000-0x0000000007133000-memory.dmpFilesize
4KB
-
memory/2888-42-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/2888-140-0x0000000007133000-0x0000000007134000-memory.dmpFilesize
4KB
-
memory/2888-109-0x000000007EDE0000-0x000000007EDE1000-memory.dmpFilesize
4KB
-
memory/2888-135-0x0000000009AB0000-0x0000000009AB1000-memory.dmpFilesize
4KB
-
memory/3820-27-0x000000000043745E-mapping.dmp
-
memory/3888-9-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3888-55-0x0000000006140000-0x0000000006141000-memory.dmpFilesize
4KB
-
memory/3888-5-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/3888-6-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/3888-7-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/3888-8-0x0000000005AA0000-0x0000000005B04000-memory.dmpFilesize
400KB
-
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3960-39-0x000000000043745E-mapping.dmp
-
memory/3960-77-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/3960-43-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3960-36-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4124-56-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/4132-58-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/4184-64-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/4184-57-0x000000000043745E-mapping.dmp
-
memory/4308-76-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB