4a6a29e358327ac53ec209cfa4e32d73286413bdeaa2da4c80b8109b7906de5c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-en-20211014
submitted
06/12/2021, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe
Size 4.6MB
Sample211206-e6nvrsdcgr
SHA256 4a6a29e358327ac53ec209cfa4e32d73286413bdeaa2da4c80b8109b7906de5c
MD5 7faddf1721f8f471bcbbd735e4032e1a
SHA1 9e1aadf3e0cd2642365599236e2dd9eaf1ab9aa9
SHA512 cf55867f2995be8ae4c6083bd9d1972630f4ab2435f65918ca9510d356c64a3b043fdc90d0ccc4c03c0144bcbd70c8bf01ede271c9b0663bd2ae9f8c0e7ccc53
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1940	472	SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe	29
PID 472 wrote to memory of 1940	472	SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe	29
PID 472 wrote to memory of 1940	472	SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe	29
PID 1940 wrote to memory of 1596	1940	powershell.exe	31
PID 1940 wrote to memory of 1596	1940	powershell.exe	31
PID 1940 wrote to memory of 1596	1940	powershell.exe	31
PID 1596 wrote to memory of 1644	1596	csc.exe	32
PID 1596 wrote to memory of 1644	1596	csc.exe	32
PID 1596 wrote to memory of 1644	1596	csc.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfbfxjut.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES734D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC733D.tmp"
      4⤵
      PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-60-0x0000000040F27000-0x0000000040F28000-memory.dmp

Download

memory/472-55-0x0000000041270000-0x000000004153E000-memory.dmp

Download

memory/472-59-0x0000000040F26000-0x0000000040F27000-memory.dmp

Download

memory/472-57-0x0000000040F22000-0x0000000040F24000-memory.dmp

Download

memory/472-58-0x0000000040F24000-0x0000000040F26000-memory.dmp

Download

memory/1596-79-0x0000000002130000-0x0000000002132000-memory.dmp

Download

memory/1940-62-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Download

memory/1940-68-0x000000000292B000-0x000000000294A000-memory.dmp

Download

memory/1940-67-0x000000001B810000-0x000000001BB0F000-memory.dmp

Download

memory/1940-66-0x0000000002924000-0x0000000002927000-memory.dmp

Download

memory/1940-65-0x0000000002922000-0x0000000002924000-memory.dmp

Download

memory/1940-64-0x0000000002920000-0x0000000002922000-memory.dmp

Download

memory/1940-63-0x000007FEEA9F0000-0x000007FEEB54D000-memory.dmp

Download

memory/1940-80-0x000000000294D000-0x000000000294E000-memory.dmp

Download