Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe
-
Size
328KB
-
MD5
59ec68c614cbd08f061b98ee2f7558b6
-
SHA1
518e36c73b44331e89a74c651ddf64e9ad79ee10
-
SHA256
1546e632cb3cd6abb0497a1e941d7c1afefd3d1bc7582b63f49d948241406b80
-
SHA512
9e7efd81d2cd1ffcc35d76f33b24f96ebfe459f9768ff29fce9d56877471dff8ef1dfe469b3ff045eb913cebc30a8b44d0c3cbe1b46f6fc7e7eaa5c853eea99b
-
SSDEEP
6144:ptxBKhzEHZ6pqRMVr5PdD1IQnAPJrueL9KEzbIgsfd+O2hht9lKSYS:ptLKhIZ60+VrVR/UJrueL9PbcV8jt9lH
Malware Config
Extracted
formbook
4u5a
Y9HWoINcPu0r7SSSKt4FCmk7
G/E64auYdhRQM4wZW2bcOaY=
bL57APty/StRpW49a+EdxA==
TppryJ0SoslHe8gJFVc=
HXxDShYIEcUJDahdv2nvl5Hlbp4=
EKaq5c6w0nV3WWlEqM4Www==
VM+YjE8XS1OLcH1roYF4zA==
OwK0wxmBGnq2Fg==
B1zy4bulyfY9tj9DK2eIkeYArpTt
Avj5JeA8m9girqfQ4+cZxA==
AOY4dmDFkCdX8HUJMw==
5cQUw3pPMYr07V8=
P7ZsN4/zt63AEw==
FYyVCOpB8Vl//kSkDLPo91Yy
jxwZTBp+5gcsccPxDF+K4bDG2Rpp0A==
iGx9AO58DRhZbXX9
prwVyLkAtlhSU6irmansg8wArpTt
uqa8ZPl+FFObOkdFNg==
tL4OhF22EDaEOkdFNg==
6exH76Z9o7eu/n86vgPE
rJfvmmO0I0KSOkdFNg==
fWeyPQpzFxdBSlPuAlA=
imNhpGXCQjOgCw==
KOLqYk7Qy278+j3g
A4mLyKgkynW7jZZt0F8=
380eDrCm3ApZbXX9
1k6VTs/04X8=
6yQgD+RiKrbnhr77i60lI/gyAQ==
rST4Evf891bSukI=
wYh6yzBy3wDSOkdFNg==
i0j/88JPuMOz
1t8w27cIepbAIqSh0G5dsiUnCw==
uI6hQB6EIE+bFW1woYF4zA==
BPL0Pin+82dmW/OhB0Fr5JHlbp4=
XC5/ZktMXzEnk+xGrPFSE+st
srT4c1/AacoX8F0=
zJeU2qIZ2VCSOkdFNg==
j4a8RbuBvuFZbXX9
asVC+9b7w7eu
L6UfqgNtQjOgCw==
yTgIJt0+qNUilvojOWqqBypDFg==
Ie006MzYHidZbXX9
fbVjId1kpfdZbXX9
w7z+dzqeJEZq2/A6vgPE
bkyOQjI+MYr07V8=
EODzbkTAOSJZbXX9
sZXWleMz4n7HrUI=
YuK38tZjKZ3eQJnC3jxvdM7D2Rpp0A==
VTJSAfJU7tISaHT/
d/gIXE8qLIr07V8=
F3XypWdIKor07V8=
uQaJTBhc8R4kr/I6vgPE
1T8ENSkKJLudaZZt0F8=
uc4eyKuvBidZbXX9
txCp1rM0oc4LhQHpKYJQUKKktIT3GWoNJw==
RMLQh/ZpQjOgCw==
0+Qt17zBCyNZbXX9
JC6jMCHmB77Eu/EFdap62w==
t4XGRQqC3kSB9Tpds2j0Wrg=
T7hCMhTkzX2mf4lVAQjjJOgz
DQ6VYEicGU+NFio7Lw==
PCpjzoTZU3Ol9T1coYF4zA==
DxVl5Jum/t5orqfQ4+cZxA==
OaM0F9KunPxoQUk/Nw==
needook.com
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
wininit.exepid process 1500 wininit.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeRegSvcs.exewininit.exedescription pid process target process PID 1992 set thread context of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 2024 set thread context of 1192 2024 RegSvcs.exe Explorer.EXE PID 1500 set thread context of 1192 1500 wininit.exe Explorer.EXE -
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
RegSvcs.exewininit.exepid process 2024 RegSvcs.exe 2024 RegSvcs.exe 2024 RegSvcs.exe 2024 RegSvcs.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exewininit.exepid process 2024 RegSvcs.exe 2024 RegSvcs.exe 2024 RegSvcs.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe 1500 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeRegSvcs.exewininit.exedescription pid process Token: SeDebugPrivilege 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe Token: SeDebugPrivilege 2024 RegSvcs.exe Token: SeDebugPrivilege 1500 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeExplorer.EXEwininit.exedescription pid process target process PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1992 wrote to memory of 2024 1992 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1192 wrote to memory of 1500 1192 Explorer.EXE wininit.exe PID 1192 wrote to memory of 1500 1192 Explorer.EXE wininit.exe PID 1192 wrote to memory of 1500 1192 Explorer.EXE wininit.exe PID 1192 wrote to memory of 1500 1192 Explorer.EXE wininit.exe PID 1500 wrote to memory of 584 1500 wininit.exe Firefox.exe PID 1500 wrote to memory of 584 1500 wininit.exe Firefox.exe PID 1500 wrote to memory of 584 1500 wininit.exe Firefox.exe PID 1500 wrote to memory of 584 1500 wininit.exe Firefox.exe PID 1500 wrote to memory of 584 1500 wininit.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
902KB
MD550338cc1fa2582fa0cad8a8fa7ceb4d2
SHA1ae697ef05b6bec38fb79ff4512ae50a303dcdbce
SHA2560815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda
SHA51202a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61
-
memory/1192-76-0x00000000040F0000-0x00000000041AB000-memory.dmpFilesize
748KB
-
memory/1192-74-0x00000000040F0000-0x00000000041AB000-memory.dmpFilesize
748KB
-
memory/1192-68-0x0000000004BE0000-0x0000000004D0E000-memory.dmpFilesize
1.2MB
-
memory/1500-77-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1500-70-0x0000000000410000-0x000000000042A000-memory.dmpFilesize
104KB
-
memory/1500-75-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1500-73-0x0000000001C20000-0x0000000001CAF000-memory.dmpFilesize
572KB
-
memory/1500-72-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/1500-71-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1500-69-0x0000000000000000-mapping.dmp
-
memory/1992-56-0x0000000000390000-0x00000000003AC000-memory.dmpFilesize
112KB
-
memory/1992-55-0x0000000000950000-0x0000000000998000-memory.dmpFilesize
288KB
-
memory/1992-54-0x00000000008F0000-0x000000000094A000-memory.dmpFilesize
360KB
-
memory/2024-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2024-67-0x0000000000190000-0x00000000001A0000-memory.dmpFilesize
64KB
-
memory/2024-66-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/2024-65-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/2024-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2024-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2024-61-0x00000000004012B0-mapping.dmp
-
memory/2024-58-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2024-57-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB