Analysis
-
max time kernel
45s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-09-2022 00:08
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
-
Size
995KB
-
MD5
68044d2b9e7c7ece6ef766f8630056c6
-
SHA1
543f725d90cff24cdfd9fbb89a42cab55dc5aca3
-
SHA256
7bfd0cbe00b3e14080e2001ec896a53d2f205caa56480a0d760f8460980da76b
-
SHA512
58bbd2b0db8ccfa6d71c28cae774295f335e936985b1693d60db42e661a32c543998e73203b6ee3165464615201f823dbf3be5135404aee44601122084788cb9
-
SSDEEP
12288:szkcqMpQbMbZpe7dootyPl4F0mdnS5i/E6Lql3tnc8JEyi18ufnBF7:szkcFQYbZGdookGzpS5i/Eg8tn
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exepid process 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exedescription pid process Token: SeDebugPrivilege 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exedescription pid process target process PID 812 wrote to memory of 1916 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1916 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1916 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1916 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1924 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1924 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1924 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1924 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 972 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 972 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 972 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 972 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 948 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 948 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 948 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 948 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1436 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1436 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1436 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe PID 812 wrote to memory of 1436 812 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-54-0x0000000000320000-0x000000000041E000-memory.dmpFilesize
1016KB
-
memory/812-55-0x0000000075131000-0x0000000075133000-memory.dmpFilesize
8KB
-
memory/812-56-0x0000000000310000-0x0000000000326000-memory.dmpFilesize
88KB
-
memory/812-57-0x00000000005A0000-0x00000000005AC000-memory.dmpFilesize
48KB
-
memory/812-58-0x0000000005870000-0x00000000058FE000-memory.dmpFilesize
568KB
-
memory/812-59-0x0000000000920000-0x0000000000954000-memory.dmpFilesize
208KB