Analysis
-
max time kernel
169s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe
-
Size
328KB
-
MD5
59ec68c614cbd08f061b98ee2f7558b6
-
SHA1
518e36c73b44331e89a74c651ddf64e9ad79ee10
-
SHA256
1546e632cb3cd6abb0497a1e941d7c1afefd3d1bc7582b63f49d948241406b80
-
SHA512
9e7efd81d2cd1ffcc35d76f33b24f96ebfe459f9768ff29fce9d56877471dff8ef1dfe469b3ff045eb913cebc30a8b44d0c3cbe1b46f6fc7e7eaa5c853eea99b
-
SSDEEP
6144:ptxBKhzEHZ6pqRMVr5PdD1IQnAPJrueL9KEzbIgsfd+O2hht9lKSYS:ptLKhIZ60+VrVR/UJrueL9PbcV8jt9lH
Malware Config
Extracted
formbook
4u5a
Y9HWoINcPu0r7SSSKt4FCmk7
G/E64auYdhRQM4wZW2bcOaY=
bL57APty/StRpW49a+EdxA==
TppryJ0SoslHe8gJFVc=
HXxDShYIEcUJDahdv2nvl5Hlbp4=
EKaq5c6w0nV3WWlEqM4Www==
VM+YjE8XS1OLcH1roYF4zA==
OwK0wxmBGnq2Fg==
B1zy4bulyfY9tj9DK2eIkeYArpTt
Avj5JeA8m9girqfQ4+cZxA==
AOY4dmDFkCdX8HUJMw==
5cQUw3pPMYr07V8=
P7ZsN4/zt63AEw==
FYyVCOpB8Vl//kSkDLPo91Yy
jxwZTBp+5gcsccPxDF+K4bDG2Rpp0A==
iGx9AO58DRhZbXX9
prwVyLkAtlhSU6irmansg8wArpTt
uqa8ZPl+FFObOkdFNg==
tL4OhF22EDaEOkdFNg==
6exH76Z9o7eu/n86vgPE
rJfvmmO0I0KSOkdFNg==
fWeyPQpzFxdBSlPuAlA=
imNhpGXCQjOgCw==
KOLqYk7Qy278+j3g
A4mLyKgkynW7jZZt0F8=
380eDrCm3ApZbXX9
1k6VTs/04X8=
6yQgD+RiKrbnhr77i60lI/gyAQ==
rST4Evf891bSukI=
wYh6yzBy3wDSOkdFNg==
i0j/88JPuMOz
1t8w27cIepbAIqSh0G5dsiUnCw==
uI6hQB6EIE+bFW1woYF4zA==
BPL0Pin+82dmW/OhB0Fr5JHlbp4=
XC5/ZktMXzEnk+xGrPFSE+st
srT4c1/AacoX8F0=
zJeU2qIZ2VCSOkdFNg==
j4a8RbuBvuFZbXX9
asVC+9b7w7eu
L6UfqgNtQjOgCw==
yTgIJt0+qNUilvojOWqqBypDFg==
Ie006MzYHidZbXX9
fbVjId1kpfdZbXX9
w7z+dzqeJEZq2/A6vgPE
bkyOQjI+MYr07V8=
EODzbkTAOSJZbXX9
sZXWleMz4n7HrUI=
YuK38tZjKZ3eQJnC3jxvdM7D2Rpp0A==
VTJSAfJU7tISaHT/
d/gIXE8qLIr07V8=
F3XypWdIKor07V8=
uQaJTBhc8R4kr/I6vgPE
1T8ENSkKJLudaZZt0F8=
uc4eyKuvBidZbXX9
txCp1rM0oc4LhQHpKYJQUKKktIT3GWoNJw==
RMLQh/ZpQjOgCw==
0+Qt17zBCyNZbXX9
JC6jMCHmB77Eu/EFdap62w==
t4XGRQqC3kSB9Tpds2j0Wrg=
T7hCMhTkzX2mf4lVAQjjJOgz
DQ6VYEicGU+NFio7Lw==
PCpjzoTZU3Ol9T1coYF4zA==
DxVl5Jum/t5orqfQ4+cZxA==
OaM0F9KunPxoQUk/Nw==
needook.com
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeRegSvcs.exeraserver.exedescription pid process target process PID 4772 set thread context of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 1940 set thread context of 968 1940 RegSvcs.exe Explorer.EXE PID 2364 set thread context of 968 2364 raserver.exe Explorer.EXE -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
RegSvcs.exeraserver.exepid process 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 968 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exeraserver.exepid process 1940 RegSvcs.exe 1940 RegSvcs.exe 1940 RegSvcs.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe 2364 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeRegSvcs.exeraserver.exedescription pid process Token: SeDebugPrivilege 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe Token: SeDebugPrivilege 1940 RegSvcs.exe Token: SeDebugPrivilege 2364 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exeExplorer.EXEraserver.exedescription pid process target process PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 4772 wrote to memory of 1940 4772 SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe RegSvcs.exe PID 968 wrote to memory of 2364 968 Explorer.EXE raserver.exe PID 968 wrote to memory of 2364 968 Explorer.EXE raserver.exe PID 968 wrote to memory of 2364 968 Explorer.EXE raserver.exe PID 2364 wrote to memory of 2148 2364 raserver.exe Firefox.exe PID 2364 wrote to memory of 2148 2364 raserver.exe Firefox.exe PID 2364 wrote to memory of 2148 2364 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.9468.18275.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-142-0x0000000002830000-0x000000000298E000-memory.dmpFilesize
1.4MB
-
memory/968-150-0x0000000007280000-0x0000000007327000-memory.dmpFilesize
668KB
-
memory/968-148-0x0000000007280000-0x0000000007327000-memory.dmpFilesize
668KB
-
memory/1940-141-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/1940-137-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1940-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1940-139-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1940-140-0x0000000001680000-0x00000000019CA000-memory.dmpFilesize
3.3MB
-
memory/1940-134-0x0000000000000000-mapping.dmp
-
memory/1940-135-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2364-143-0x0000000000000000-mapping.dmp
-
memory/2364-145-0x0000000000890000-0x00000000008BD000-memory.dmpFilesize
180KB
-
memory/2364-144-0x00000000001F0000-0x000000000020F000-memory.dmpFilesize
124KB
-
memory/2364-146-0x0000000002700000-0x0000000002A4A000-memory.dmpFilesize
3.3MB
-
memory/2364-147-0x0000000002590000-0x000000000261F000-memory.dmpFilesize
572KB
-
memory/2364-149-0x0000000000890000-0x00000000008BD000-memory.dmpFilesize
180KB
-
memory/4772-132-0x0000000000D20000-0x0000000000D7A000-memory.dmpFilesize
360KB
-
memory/4772-133-0x0000000009E60000-0x0000000009EFC000-memory.dmpFilesize
624KB