Analysis
- max time kernel
138s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
29/05/2023, 21:30
General
- Target SecuriteInfo.com.Win32.Evo-gen.26890.14513.exe
- Size 546KB
- Sample230529-1cfsysdf37
- SHA256 e2160fb0cdb707aa84430207c6357cb9bc099ab4cbbc5299d8be7208a41a718b
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26890.14513.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26890.14513.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 9643⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1524 -ip 15241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1524-148-0x0000000000400000-0x0000000000706000-memory.dmp
memory/1524-135-0x00000000009F0000-0x00000000009F7000-memory.dmp
memory/1524-136-0x00000000028E0000-0x0000000002CE0000-memory.dmp
memory/1524-137-0x00000000028E0000-0x0000000002CE0000-memory.dmp
memory/1524-134-0x0000000000980000-0x00000000009F0000-memory.dmp
memory/1524-139-0x0000000002870000-0x00000000028A6000-memory.dmp
memory/1524-145-0x0000000000400000-0x0000000000706000-memory.dmp
memory/1524-146-0x0000000002870000-0x00000000028A6000-memory.dmp
memory/1776-150-0x00000249B3D90000-0x00000249B3D97000-memory.dmp
memory/1776-155-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-138-0x00000249B3B30000-0x00000249B3B33000-memory.dmp
memory/1776-151-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-152-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-153-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-154-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-149-0x00000249B3B30000-0x00000249B3B33000-memory.dmp
memory/1776-157-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-158-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-159-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-160-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-161-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp
memory/1776-162-0x00007FF492A10000-0x00007FF492B3D000-memory.dmp