Analysis
- max time kernel
166s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2022, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe
- Size 500KB
- Sample221109-mwp9vagbd2
- SHA256 ebc1c03760f08f8e264c69a6515c4dfd91698ad720f625c02b389a5081380e9b
- MD5 2d12296e003678c63e1a7d3ddc92eed2
- SHA1 fd57a4e9ca4a2c98c341949784be273b6ac48122
- SHA512 4732ba7c0f12474fddc403c1dcbe9cb6313cd5b33ee62643cfa9cdb965cb07edff0e316d33c67da8da8b313ef04bb90f3ef98d01e6c40db6068d0b9d54f1481c
- SSDEEP 12288:GGVs61y5fESvs5eg+uxTV+VRiUqxVPzzk5ub6P:B1gDRuxTVuRUrzk5u2P
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 4468 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 81 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 2432 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 82 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 4384 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 83 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 2264 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 84 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85 PID 984 wrote to memory of 5048 984 SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.MSIL.Agent.14337.15759.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:4468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:2432
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:4384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:2264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:5048
-