Analysis
-
max time kernel
90s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe
Resource
win10v2004-20221111-en
General
-
Target
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe
-
Size
1.2MB
-
MD5
d3d1c599e9be0b80dae0078107f66349
-
SHA1
ab9303aa6f5c3f13ad9dc52a25cedc1ffff81a45
-
SHA256
4b5393731fe1fc36d0e188b5e38defd0ba84a865efdd9e944065c1831a412f33
-
SHA512
f0e6198036458245648c641dd16ce2b1d2ea7d8925256882b1c289f290cc2255c7943fa225b299b80846aa0b349d2032b930786bc35f91e98569ec2edfbe2349
-
SSDEEP
24576:EpjZnbCkI13pDOx5ZhIthM8pnQPbQ6TU8fMfrIBnG30YCo:EpjZnbCkIFOQthTQDQ3wMTIBn+9
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exepowershell.exepid process 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe 3864 powershell.exe 3864 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exepowershell.exedescription pid process Token: SeDebugPrivilege 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe Token: SeDebugPrivilege 3864 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.execmd.exedescription pid process target process PID 4776 wrote to memory of 1780 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe cmd.exe PID 4776 wrote to memory of 1780 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe cmd.exe PID 4776 wrote to memory of 1780 4776 SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe cmd.exe PID 1780 wrote to memory of 3864 1780 cmd.exe powershell.exe PID 1780 wrote to memory of 3864 1780 cmd.exe powershell.exe PID 1780 wrote to memory of 3864 1780 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1780-138-0x0000000000000000-mapping.dmp
-
memory/3864-144-0x0000000006710000-0x000000000672E000-memory.dmpFilesize
120KB
-
memory/3864-139-0x0000000000000000-mapping.dmp
-
memory/3864-148-0x0000000006CD0000-0x0000000006CF2000-memory.dmpFilesize
136KB
-
memory/3864-147-0x00000000079A0000-0x0000000007A36000-memory.dmpFilesize
600KB
-
memory/3864-141-0x0000000005890000-0x0000000005EB8000-memory.dmpFilesize
6.2MB
-
memory/3864-146-0x0000000006BF0000-0x0000000006C0A000-memory.dmpFilesize
104KB
-
memory/3864-145-0x0000000007D80000-0x00000000083FA000-memory.dmpFilesize
6.5MB
-
memory/3864-140-0x0000000005160000-0x0000000005196000-memory.dmpFilesize
216KB
-
memory/3864-143-0x0000000006030000-0x0000000006096000-memory.dmpFilesize
408KB
-
memory/3864-142-0x0000000005830000-0x0000000005852000-memory.dmpFilesize
136KB
-
memory/4776-137-0x0000000008CA0000-0x0000000008D06000-memory.dmpFilesize
408KB
-
memory/4776-132-0x00000000002F0000-0x000000000042C000-memory.dmpFilesize
1.2MB
-
memory/4776-134-0x0000000004DD0000-0x0000000004E62000-memory.dmpFilesize
584KB
-
memory/4776-133-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB
-
memory/4776-136-0x0000000008870000-0x000000000890C000-memory.dmpFilesize
624KB
-
memory/4776-135-0x0000000004F60000-0x0000000004F6A000-memory.dmpFilesize
40KB