f4d6fa18bba78d69e878956143665a8f6b489ad5fb5b292507debdc5d3db7008

Analysis

max time kernel
70s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
Size

12.9MB
MD5

9fef7d7554ca2ed502bad3981933528f
SHA1

0e395c5ac3d9d9a6292d76ea17c68ad32324f7da
SHA256

f4d6fa18bba78d69e878956143665a8f6b489ad5fb5b292507debdc5d3db7008
SHA512

785bdc61e5bf52cb84acc2f53b1bcdb48559bd4dfd66f832d2511de7ef0778033138e237790c0e4cfe406512003e8ac3840918366366903a91aa6323ea2ec8d9
SSDEEP

393216:kfyUxSEpVci5KAqTcqxIJGYMkHZ6K/qE:kKuHHcSqxZY16KyE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 752	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	28
PID 872 wrote to memory of 752	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	28
PID 872 wrote to memory of 752	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	28
PID 872 wrote to memory of 752	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	28
PID 872 wrote to memory of 1744	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	29
PID 872 wrote to memory of 1744	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	29
PID 872 wrote to memory of 1744	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	29
PID 872 wrote to memory of 1744	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	29
PID 872 wrote to memory of 1396	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	30
PID 872 wrote to memory of 1396	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	30
PID 872 wrote to memory of 1396	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	30
PID 872 wrote to memory of 1396	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	30
PID 872 wrote to memory of 1612	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	31
PID 872 wrote to memory of 1612	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	31
PID 872 wrote to memory of 1612	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	31
PID 872 wrote to memory of 1612	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	31
PID 872 wrote to memory of 1756	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	32
PID 872 wrote to memory of 1756	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	32
PID 872 wrote to memory of 1756	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	32
PID 872 wrote to memory of 1756	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	32
PID 872 wrote to memory of 1956	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	33
PID 872 wrote to memory of 1956	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	33
PID 872 wrote to memory of 1956	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	33
PID 872 wrote to memory of 1956	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	33
PID 872 wrote to memory of 1616	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	34
PID 872 wrote to memory of 1616	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	34
PID 872 wrote to memory of 1616	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	34
PID 872 wrote to memory of 1616	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	34
PID 872 wrote to memory of 880	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	35
PID 872 wrote to memory of 880	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	35
PID 872 wrote to memory of 880	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	35
PID 872 wrote to memory of 880	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	35
PID 872 wrote to memory of 932	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	36
PID 872 wrote to memory of 932	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	36
PID 872 wrote to memory of 932	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	36
PID 872 wrote to memory of 932	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	36
PID 872 wrote to memory of 916	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	37
PID 872 wrote to memory of 916	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	37
PID 872 wrote to memory of 916	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	37
PID 872 wrote to memory of 916	872	SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe	37

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:752
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830.exe
  2⤵
  PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-54-0x0000000000020000-0x0000000000D16000-memory.dmp

Filesize
13.0MB

Download
memory/872-55-0x0000000002BF0000-0x0000000002CE2000-memory.dmp

Filesize
968KB

Download
memory/872-56-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-59-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-57-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-61-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-63-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-65-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-67-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-71-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-69-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-73-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-75-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-78-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-77-0x0000000005550000-0x0000000005590000-memory.dmp

Filesize
256KB

Download
memory/872-82-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-80-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-84-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-86-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-88-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-90-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-92-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-94-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-98-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-100-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-96-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-106-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-104-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-102-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-108-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-110-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-112-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-116-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-118-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-114-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-120-0x0000000002BF0000-0x0000000002CDC000-memory.dmp

Filesize
944KB

Download
memory/872-1101-0x0000000002D40000-0x0000000002DAA000-memory.dmp

Filesize
424KB

Download
memory/872-1102-0x00000000054B0000-0x00000000054FC000-memory.dmp

Filesize
304KB

Download
memory/872-1103-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/872-1104-0x0000000005550000-0x0000000005590000-memory.dmp

Filesize
256KB

Download