Overview

overview

10

Static

static

SecuriteIn...91.exe

windows7_x64

8

SecuriteIn...91.exe

windows10_x64

10

Analysis

  • max time kernel
    29s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    05-05-2021 13:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.MSIL.Kryptik.4625f314.19991.25291.exe

  • Size

    897KB

  • MD5

    9f910ba7ff05efd30eb1c2316bb488e0

  • SHA1

    3b428f5cf8b0c43b8b63bbaf728669a83f66458e

  • SHA256

    0c2f78458061b2e848305409a90351eff2c4c31eed1a4667b6366bfdc43ef52a

  • SHA512

    5f6300857bce04ef5e883bb219d3f2257acdada1c29cec9dff0d438a8190f784b0c7bde44dbe80adb7f28fefe03c9ec57d0300066bed46b838a91d92a3f7c189

Score
8/10
agilenet

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Kryptik.4625f314.19991.25291.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Kryptik.4625f314.19991.25291.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    MD5

    54a47f6b5e09a77e61649109c6a08866

    SHA1

    4af001b3c3816b860660cf2de2c0fd3c1dfb4878

    SHA256

    121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2

    SHA512

    88ee0ef5af1b0b38c19ab4c307636352fc403ea74f3bfb17e246f7fd815ac042183086133cd9fe805bd47e15854776871bb7d384e419862c91503eeb82bfb419

    Download Submit
  • \Users\Admin\AppData\Local\Temp\svchost.exe
    MD5

    54a47f6b5e09a77e61649109c6a08866

    SHA1

    4af001b3c3816b860660cf2de2c0fd3c1dfb4878

    SHA256

    121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2

    SHA512

    88ee0ef5af1b0b38c19ab4c307636352fc403ea74f3bfb17e246f7fd815ac042183086133cd9fe805bd47e15854776871bb7d384e419862c91503eeb82bfb419

    Download Submit
  • memory/1044-69-0x0000000000400000-0x000000000047E000-memory.dmp
    Filesize

    504KB

    Download
  • memory/1044-70-0x000000000047823F-mapping.dmp
    Download
  • memory/1044-72-0x00000000757C1000-0x00000000757C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1044-73-0x0000000000400000-0x000000000047E000-memory.dmp
    Filesize

    504KB

    Download
  • memory/1848-60-0x0000000000870000-0x0000000000871000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1848-62-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1848-64-0x00000000005F0000-0x0000000000611000-memory.dmp
    Filesize

    132KB

    Download
  • memory/1848-65-0x0000000004CA1000-0x0000000004CA2000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1848-66-0x00000000006C0000-0x00000000006CB000-memory.dmp
    Filesize

    44KB

    Download
  • memory/1848-67-0x0000000000820000-0x0000000000821000-memory.dmp
    Filesize

    4KB

    Download