Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2023 05:27
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe
Resource
win7-20230220-en
General
-
Target
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe
-
Size
3.8MB
-
MD5
d07b7112b39c9eee7eaeba1adb099543
-
SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c
-
SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
-
SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
SSDEEP
98304:cCtEONaf1kMdpRfZJDRJwdaUNa8gPgEICG6x098gJ2uCB9Ml:RE0UkkHRJuNawLCG6x+8gJFm
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tewu.exetewu.exepid process 1992 tewu.exe 632 tewu.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 1704 vbc.exe 1704 vbc.exe 1704 vbc.exe 1704 vbc.exe 2012 vbc.exe 1512 vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exetewu.exetewu.exedescription pid process target process PID 1728 set thread context of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1992 set thread context of 2012 1992 tewu.exe vbc.exe PID 632 set thread context of 1512 632 tewu.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1044 schtasks.exe 1652 schtasks.exe 684 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1704 vbc.exe Token: SeShutdownPrivilege 1704 vbc.exe Token: SeDebugPrivilege 2012 vbc.exe Token: SeShutdownPrivilege 2012 vbc.exe Token: SeDebugPrivilege 1512 vbc.exe Token: SeShutdownPrivilege 1512 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 1704 vbc.exe 1704 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.execmd.exetaskeng.exetewu.execmd.exedescription pid process target process PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1704 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe vbc.exe PID 1728 wrote to memory of 1440 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1440 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1440 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1440 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1716 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1716 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1716 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 1716 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 520 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 520 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 520 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1728 wrote to memory of 520 1728 SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe cmd.exe PID 1716 wrote to memory of 684 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 684 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 684 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 684 1716 cmd.exe schtasks.exe PID 568 wrote to memory of 1992 568 taskeng.exe tewu.exe PID 568 wrote to memory of 1992 568 taskeng.exe tewu.exe PID 568 wrote to memory of 1992 568 taskeng.exe tewu.exe PID 568 wrote to memory of 1992 568 taskeng.exe tewu.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 2012 1992 tewu.exe vbc.exe PID 1992 wrote to memory of 1980 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1980 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1980 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1980 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 2032 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 2032 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 2032 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 2032 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1960 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1960 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1960 1992 tewu.exe cmd.exe PID 1992 wrote to memory of 1960 1992 tewu.exe cmd.exe PID 2032 wrote to memory of 1044 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 1044 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 1044 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 1044 2032 cmd.exe schtasks.exe PID 568 wrote to memory of 632 568 taskeng.exe tewu.exe PID 568 wrote to memory of 632 568 taskeng.exe tewu.exe PID 568 wrote to memory of 632 568 taskeng.exe tewu.exe PID 568 wrote to memory of 632 568 taskeng.exe tewu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {6B38D744-6EC6-4839-8DE2-67562FD061FD} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeC:\Users\Admin\AppData\Roaming\tewu\tewu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeC:\Users\Admin\AppData\Roaming\tewu\tewu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
memory/632-127-0x00000000006C0000-0x0000000000700000-memory.dmpFilesize
256KB
-
memory/632-110-0x00000000008B0000-0x0000000000C84000-memory.dmpFilesize
3.8MB
-
memory/1512-131-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/1512-130-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/1512-129-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/1512-124-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/1704-80-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-62-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-66-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-72-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-74-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-76-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-75-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-79-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-55-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-81-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-82-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-83-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-84-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-63-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1704-64-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-56-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-57-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-104-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-103-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-105-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-106-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-107-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-108-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1704-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1728-58-0x0000000004EA0000-0x0000000004EE0000-memory.dmpFilesize
256KB
-
memory/1728-54-0x0000000000230000-0x0000000000604000-memory.dmpFilesize
3.8MB
-
memory/1992-92-0x00000000022B0000-0x00000000022F0000-memory.dmpFilesize
256KB
-
memory/1992-87-0x0000000000270000-0x0000000000644000-memory.dmpFilesize
3.8MB
-
memory/2012-102-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-100-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB