d37b127c493bbf59bff2017e49513c0f80a5db906715f5e22bbb23d24c2cca3b

General

Target

SecuriteInfo.com.Trojan.Siggen17.50772.426.exe
Size

502KB
MD5

d1d7f23ea413b011f029e5d97890c41e
SHA1

82153f7e21609a7dfb1ee98e56915393bdb504b8
SHA256

d37b127c493bbf59bff2017e49513c0f80a5db906715f5e22bbb23d24c2cca3b
SHA512

a7bfc0c64be27fd45ab3d0b0aab47553a25de6535667e643b3caeecc8b9b7557b5ca361936ef2a32d44387ba5418ad5ece5065403992e1fbda869e7a49e5e298

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen17.50772.426.exe

description pid process target process

PID 2828 set thread context of 1452 2828 SecuriteInfo.com.Trojan.Siggen17.50772.426.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

1452 MSBuild.exe
1452 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

1452 MSBuild.exe

description	pid	process	target process
PID 2828 set thread context of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe

pid	process
1452	MSBuild.exe
1452	MSBuild.exe

pid	process
1452	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen17.50772.426.exeMSBuild.exe

description	pid	process	target process
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 2828 wrote to memory of 1452	2828	SecuriteInfo.com.Trojan.Siggen17.50772.426.exe	MSBuild.exe
PID 1452 wrote to memory of 4244	1452	MSBuild.exe	iexplore.exe
PID 1452 wrote to memory of 4244	1452	MSBuild.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen17.50772.426.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen17.50772.426.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:4244
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      4⤵
      PID:4744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-136-0x0000000000000000-mapping.dmp

Download
memory/1452-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1452-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1452-142-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2828-130-0x0000000000960000-0x00000000009E4000-memory.dmp

Filesize
528KB

Download
memory/2828-131-0x00000000059F0000-0x0000000005F94000-memory.dmp

Filesize
5.6MB

Download
memory/2828-132-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/2828-133-0x00000000054E0000-0x000000000557C000-memory.dmp

Filesize
624KB

Download
memory/2828-134-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

Filesize
40KB

Download
memory/2828-135-0x0000000005940000-0x00000000059A6000-memory.dmp

Filesize
408KB

Download
memory/4744-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing