Overview

overview

8

Static

static

SecuriteIn...49.exe

windows7_x64

8

SecuriteIn...49.exe

windows10_x64

8

Resubmissions

22-01-2021 15:07

210122-v4977lkajj 10

22-01-2021 15:00

210122-6x85x34v6a 8

22-01-2021 09:16

210122-dvb5rvar9x 8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22-01-2021 09:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe

  • Size

    8.8MB

  • MD5

    8b664f8a44dcb056095bc43bcb854c11

  • SHA1

    3f54621b0fd5bb9ae4f20c41fdc937a6654f9269

  • SHA256

    e3c21f2f79c6a027881f1b74728c61d4fbb6fe6921f8840ce2dc11aabc9ceaa4

  • SHA512

    71d2a1359a7ff610d3b64eeeebc406ca2b00139db0b73484a679563eb5424a7fbd194dde7f2cca0cee6f5f240f58f2541e809d2d880dc32b7f6009335e066d51

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Users\Admin\AppData\Local\Temp\is-IPD9V.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IPD9V.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp" /SL5="$20158,8956095,58368,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-IPD9V.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp
    MD5

    1afbd25db5c9a90fe05309f7c4fbcf09

    SHA1

    baf330b5c249ca925b4ea19a52fe8b2c27e547fa

    SHA256

    3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

    SHA512

    3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-IPD9V.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp
    MD5

    1afbd25db5c9a90fe05309f7c4fbcf09

    SHA1

    baf330b5c249ca925b4ea19a52fe8b2c27e547fa

    SHA256

    3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

    SHA512

    3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

    Download Submit
  • memory/792-2-0x00000000765E1000-0x00000000765E3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/792-7-0x0000000000401000-0x000000000040C000-memory.dmp
    Filesize

    44KB

    Download
  • memory/1176-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1176-8-0x00000000003C0000-0x00000000003C1000-memory.dmp
    Filesize

    4KB

    Download