Analysis
-
max time kernel
60s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
-
Size
1.0MB
-
MD5
21eb8736dd89da5191e78fde4a3ca3da
-
SHA1
c96857cc2d0177ec028bba3e467f3930e5c02f85
-
SHA256
e8ed49650b42ebb3a251a7353809309e94f885316bf1b0153def1c180628cee4
-
SHA512
71ba19fd8cb5bbef1f4fb0d9a03ab7b9c8724263b0ab38e5c9cb979b65f42e7743c3e46050fc2b2fc52087a5e4523b8482c3a9acd3858a8bb71b536f4a220b6e
-
SSDEEP
12288:oyRPYYsZ1DX/VDJtV7oT6P9GJ2LjmgoxQT0z/ZBQfWh+QJFuUtxEr5Cd4uUVhjPO:oCYYk8WP9GcWje0zXhnzxEPZV
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1617.32609.exepid process 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1617.32609.exedescription pid process Token: SeDebugPrivilege 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1617.32609.exedescription pid process target process PID 1256 wrote to memory of 1568 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1568 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1568 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1568 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1600 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1600 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1600 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1600 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1496 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1496 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1496 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1496 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1696 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1696 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1696 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 1696 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 828 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 828 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 828 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe PID 1256 wrote to memory of 828 1256 SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-54-0x0000000000340000-0x000000000044C000-memory.dmpFilesize
1.0MB
-
memory/1256-55-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1256-56-0x00000000006B0000-0x00000000006C8000-memory.dmpFilesize
96KB
-
memory/1256-57-0x0000000000460000-0x000000000046C000-memory.dmpFilesize
48KB
-
memory/1256-58-0x0000000005EC0000-0x0000000005F68000-memory.dmpFilesize
672KB
-
memory/1256-59-0x0000000007EC0000-0x0000000007F30000-memory.dmpFilesize
448KB