Analysis
-
max time kernel
37s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-10-2021 08:52
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe
-
Size
1.9MB
-
MD5
13003cbfb6d2adfeea85952f8172c4f7
-
SHA1
e5ef2dd654b50ed7be455cbe7aaabaa7acaedc80
-
SHA256
9c8590c7165b453dd0792be3cf51e200961a1ed9cf1154768ee86f7018db8fd9
-
SHA512
ccb7e4dfb0454711cb50a619497072082bae3111ac8ba76b22d1f95af9721762b3b493596191f879bdca3d5872315009bb8f021ac131d9a1067e1dff91696824
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
conhost.exedescription pid process Token: SeDebugPrivilege 1684 conhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exedescription pid process target process PID 1040 wrote to memory of 1684 1040 SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe conhost.exe PID 1040 wrote to memory of 1684 1040 SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe conhost.exe PID 1040 wrote to memory of 1684 1040 SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.InjectNET.14.3934.31899.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-115-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-114-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-116-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-117-0x00000209B6F60000-0x00000209B7149000-memory.dmpFilesize
1.9MB
-
memory/1684-119-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-118-0x00000209D17C0000-0x00000209D17C2000-memory.dmpFilesize
8KB
-
memory/1684-120-0x00000209D19C0000-0x00000209D1BA5000-memory.dmpFilesize
1.9MB
-
memory/1684-122-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-123-0x00000209B8DB0000-0x00000209B8DB1000-memory.dmpFilesize
4KB
-
memory/1684-124-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-125-0x00000209B8D50000-0x00000209B8D52000-memory.dmpFilesize
8KB
-
memory/1684-127-0x00000209D17C6000-0x00000209D17C7000-memory.dmpFilesize
4KB
-
memory/1684-126-0x00000209D17C3000-0x00000209D17C5000-memory.dmpFilesize
8KB