Overview

overview

3

Static

static

3

SecuriteIn...74.exe

windows7-x64

3

SecuriteIn...74.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 09:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.S-909ca299.Eldorado.474.exe

  • Size

    272KB

  • MD5

    cbc7ee25d02d1ce2729da6a7b3fe0819

  • SHA1

    88818b140676838fb3a0624bd712ce4d0fc05f27

  • SHA256

    c10d435c9900de72690b75c011768e531863c09da1d497d2e36947857397e137

  • SHA512

    158c2c92f921d9c56beae5b0d22d33bf81fc10d8d1685be5041138d4e33607e5b5c97eba7ca12b013439b12b84225e2bb7a283a91470f947dacfb729869967c9

  • SSDEEP

    6144:3SaeLxmjZ80mHQrA6eXsn1kG5rrfyBjf+YyBepOgA:3+xmjZ8rHrkfISYyBepOg

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.S-909ca299.Eldorado.474.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.S-909ca299.Eldorado.474.exe"
    1⤵
      PID:3456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 192
        2⤵
        • Program crash
        PID:3036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 244
        2⤵
        • Program crash
        PID:640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3456 -ip 3456
      1⤵
        PID:4636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3456 -ip 3456
        1⤵
          PID:1028

        Network

        • flag-us
          DNS
          104.219.191.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          104.219.191.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          1.208.79.178.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          1.208.79.178.in-addr.arpa
          IN PTR
          Response
          1.208.79.178.in-addr.arpa
          IN PTR
          https-178-79-208-1amsllnwnet
        • flag-us
          DNS
          0.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          0.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          133.211.185.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          133.211.185.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          86.8.109.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          86.8.109.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          58.55.71.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          58.55.71.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          134.32.126.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          134.32.126.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          196.249.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          196.249.167.52.in-addr.arpa
          IN PTR
          Response
        • 87.248.202.1:80
          260 B
           5
        • 87.248.202.1:80
          260 B
           5
        • 40.125.122.176:443
          260 B
           5
        • 40.125.122.176:443
          260 B
           5
        • 40.125.122.176:443
          260 B
           5
        • 173.223.113.164:443
          322 B
           7
        • 173.223.113.131:80
          322 B
           7
        • 204.79.197.203:80
          322 B
           7
        • 40.125.122.176:443
          260 B
           5
        • 40.125.122.176:443
          260 B
           5
        • 40.125.122.176:443
          260 B
           5
        • 8.8.8.8:53
          104.219.191.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          104.219.191.52.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          1.208.79.178.in-addr.arpa
          dns
          71 B
           116 B
           1
          1

          DNS Request

          1.208.79.178.in-addr.arpa

        • 8.8.8.8:53
          0.159.190.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          0.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          133.211.185.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          133.211.185.52.in-addr.arpa

        • 8.8.8.8:53
          86.8.109.52.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          86.8.109.52.in-addr.arpa

        • 8.8.8.8:53
          134.32.126.40.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          134.32.126.40.in-addr.arpa

        • 8.8.8.8:53
          58.55.71.13.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          58.55.71.13.in-addr.arpa

        • 8.8.8.8:53
          196.249.167.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          196.249.167.52.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.