Analysis
-
max time kernel
74s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-07-2021 14:06
General
-
Target
SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
-
Size
1.3MB
-
MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0
-
SHA1
a26b4056669b0866d248e6c5a6a29de4f41314ef
-
SHA256
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
-
SHA512
aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe"C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe"{path}"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0
SHA1a26b4056669b0866d248e6c5a6a29de4f41314ef
SHA256ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
SHA512aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca
-
MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0
SHA1a26b4056669b0866d248e6c5a6a29de4f41314ef
SHA256ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
SHA512aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca
-
MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0
SHA1a26b4056669b0866d248e6c5a6a29de4f41314ef
SHA256ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
SHA512aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca
-
MD5
e52c0a3d3d42dfb15b61fd9cbbf245fa
SHA12626d7a0c22d59d508a13a70c96c7e0e704f4c3b
SHA256a48d390098acdbe46053554028aa5c1b3d648dcedaceb3baad3241c2600166e8
SHA51278fb9f8808f553322d1c39f735957faf1981879c85a6f70c1608d0399f123a349168a3a07a8677d71e44b99ca48c4550e39704096ba4da929ce86025f1bfe637
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
452KB
-
-
Filesize
452KB
-
-
Filesize
5.0MB
-