Overview

overview

10

Static

static

SecuriteIn...35.exe

windows7-x64

10

SecuriteIn...35.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    41s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2022 08:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Siggen18.52374.5412.12335.exe

  • Size

    1018KB

  • MD5

    f58357e2f32909d85790128c9f6d08c0

  • SHA1

    b75dea10a3f9ebcce95c2dbf9d20a98fe3c5bd78

  • SHA256

    462342db316acd9578f80e1b80471237fecc9479d2d70f7f413b1b47cd302400

  • SHA512

    52aec13d3af40f0396a31ed278f3d243bf3eb6bebaac425bd8cc050cf399e47eb1e6ec851eb024c56d4ccc1d76d958aa2ba87ec94e2a7e72c9bf6484cdf949d8

  • SSDEEP

    12288:ithx+HhW51Ur3EUfGTLX+fw0aSdpjRAvqYzlJLO/xbf:aD4h/jtfw0PmzlJLO/hf

Score
10/10
asyncratpersistencerat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Async RAT payload 6 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen18.52374.5412.12335.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen18.52374.5412.12335.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
        PID:1240
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:992

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/992-59-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-58-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-61-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-62-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-64-0x000000000040C79E-mapping.dmp
      Download
    • memory/992-63-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-66-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/992-68-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1668-54-0x0000000000320000-0x0000000000424000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1668-55-0x0000000000700000-0x00000000007AC000-memory.dmp
      Filesize

      688KB

      Download
    • memory/1668-56-0x0000000075071000-0x0000000075073000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1668-57-0x0000000004C50000-0x0000000004CE2000-memory.dmp
      Filesize

      584KB

      Download