Overview

overview

8

Static

static

SecuriteIn...49.exe

windows7_x64

8

SecuriteIn...49.exe

windows10_x64

8

Resubmissions

22-01-2021 15:07

210122-v4977lkajj 10

22-01-2021 15:00

210122-6x85x34v6a 8

22-01-2021 09:16

210122-dvb5rvar9x 8

Analysis

  • max time kernel
    131s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-01-2021 09:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe

  • Size

    8.8MB

  • MD5

    8b664f8a44dcb056095bc43bcb854c11

  • SHA1

    3f54621b0fd5bb9ae4f20c41fdc937a6654f9269

  • SHA256

    e3c21f2f79c6a027881f1b74728c61d4fbb6fe6921f8840ce2dc11aabc9ceaa4

  • SHA512

    71d2a1359a7ff610d3b64eeeebc406ca2b00139db0b73484a679563eb5424a7fbd194dde7f2cca0cee6f5f240f58f2541e809d2d880dc32b7f6009335e066d51

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:984
    • C:\Users\Admin\AppData\Local\Temp\is-CV6GF.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CV6GF.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp" /SL5="$20110,8956095,58368,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
      2⤵
      • Executes dropped EXE
      PID:3412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/984-4-0x0000000000401000-0x000000000040C000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3412-5-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

    Download