Overview

overview

6

Static

static

SecuriteIn...56.exe

windows7_x64

5

SecuriteIn...56.exe

windows10_x64

6

Analysis

  • max time kernel
    96s
  • max time network
    68s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-07-2021 03:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Zusy.394472.4088.27156.exe

  • Size

    227KB

  • MD5

    f6fa09a57fafac2e5cddc581361cd39b

  • SHA1

    23b4dbe6b269c05e5d383a29221ec6151b6d5b5c

  • SHA256

    21b566d7ce91cf64d9161fde5a3c1370252ac57128427181cf42ad81a8fdd241

  • SHA512

    f546239db742b9ea5cbb5b1e79dcf66f8b88ebab8f8ffc1e123da916b105ab50dadbdec832811c0dd0e05efc5033d54d73173101fb224f9aa0bf573b676966f9

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.4088.27156.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.4088.27156.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.4088.27156.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/652-115-0x0000000000480000-0x000000000052E000-memory.dmp
    Filesize

    696KB

    Download
  • memory/3972-114-0x00000000007374AE-mapping.dmp
    Download
  • memory/3972-116-0x0000000002750000-0x0000000002751000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3972-117-0x0000000002751000-0x0000000002752000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3972-118-0x0000000002752000-0x0000000002753000-memory.dmp
    Filesize

    4KB

    Download