Overview

overview

9

Static

static

SecuriteIn...04.exe

windows7_x64

9

SecuriteIn...04.exe

windows10_x64

9

Analysis

  • max time kernel
    15s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    07/09/2021, 08:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Variant.Application.Miner.32.11010.10304.exe
  • Size 8.3MB
  • Sample210907-knsznafebj
  • SHA256 88f1c469317a8dfaf4c6fd17951a7d218e6a98445fa7ec12cb35ef786d1c2b2f
  • MD5 SHA1 SHA512
Score
9/10
evasiontrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Application.Miner.32.11010.10304.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Application.Miner.32.11010.10304.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3176

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3176-115-0x00007FF7D6AF0000-0x00007FF7D7C7A000-memory.dmp
        Download