e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998

Analysis

max time kernel
54s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Heur.24719.4239.exe
Size

1.6MB
MD5

170860057f4aad06ddbeea0ca2b3f1b6
SHA1

db04c735b769df458518f959ae7eca39cfa06213
SHA256

e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
SHA512

f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
SSDEEP

24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1240	SecuriteInfo.com.Heur.24719.4239.exe
1240	SecuriteInfo.com.Heur.24719.4239.exe
1240	SecuriteInfo.com.Heur.24719.4239.exe
1240	SecuriteInfo.com.Heur.24719.4239.exe
1240	SecuriteInfo.com.Heur.24719.4239.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	SecuriteInfo.com.Heur.24719.4239.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1928	1240	SecuriteInfo.com.Heur.24719.4239.exe	27
PID 1240 wrote to memory of 1928	1240	SecuriteInfo.com.Heur.24719.4239.exe	27
PID 1240 wrote to memory of 1928	1240	SecuriteInfo.com.Heur.24719.4239.exe	27
PID 1240 wrote to memory of 1928	1240	SecuriteInfo.com.Heur.24719.4239.exe	27
PID 1240 wrote to memory of 1260	1240	SecuriteInfo.com.Heur.24719.4239.exe	28
PID 1240 wrote to memory of 1260	1240	SecuriteInfo.com.Heur.24719.4239.exe	28
PID 1240 wrote to memory of 1260	1240	SecuriteInfo.com.Heur.24719.4239.exe	28
PID 1240 wrote to memory of 1260	1240	SecuriteInfo.com.Heur.24719.4239.exe	28
PID 1240 wrote to memory of 876	1240	SecuriteInfo.com.Heur.24719.4239.exe	29
PID 1240 wrote to memory of 876	1240	SecuriteInfo.com.Heur.24719.4239.exe	29
PID 1240 wrote to memory of 876	1240	SecuriteInfo.com.Heur.24719.4239.exe	29
PID 1240 wrote to memory of 876	1240	SecuriteInfo.com.Heur.24719.4239.exe	29
PID 1240 wrote to memory of 1524	1240	SecuriteInfo.com.Heur.24719.4239.exe	30
PID 1240 wrote to memory of 1524	1240	SecuriteInfo.com.Heur.24719.4239.exe	30
PID 1240 wrote to memory of 1524	1240	SecuriteInfo.com.Heur.24719.4239.exe	30
PID 1240 wrote to memory of 1524	1240	SecuriteInfo.com.Heur.24719.4239.exe	30
PID 1240 wrote to memory of 1828	1240	SecuriteInfo.com.Heur.24719.4239.exe	31
PID 1240 wrote to memory of 1828	1240	SecuriteInfo.com.Heur.24719.4239.exe	31
PID 1240 wrote to memory of 1828	1240	SecuriteInfo.com.Heur.24719.4239.exe	31
PID 1240 wrote to memory of 1828	1240	SecuriteInfo.com.Heur.24719.4239.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
  2⤵
  PID:1260
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
  2⤵
  PID:876
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
  2⤵
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"
  2⤵
  PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-54-0x0000000000340000-0x00000000004D6000-memory.dmp

Filesize
1.6MB

Download
memory/1240-55-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1240-56-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1240-57-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1240-58-0x00000000006E0000-0x00000000006EC000-memory.dmp

Filesize
48KB

Download
memory/1240-59-0x0000000005DA0000-0x0000000005ED8000-memory.dmp

Filesize
1.2MB

Download
memory/1240-60-0x000000000A4F0000-0x000000000A6A0000-memory.dmp

Filesize
1.7MB

Download