Analysis
-
max time kernel
85s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 18:46
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Resource
win10v2004-20230621-en
General
-
Target
SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
-
Size
12.3MB
-
MD5
78ca6266294789d169792c330758cb4c
-
SHA1
01474dea306722d9da1ae2a83aa089912b989861
-
SHA256
a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787
-
SHA512
c5c36b2177d3bfdb3ff9a3730587af7bbc76b3c53b0934a6737cd3e6e248e3d4da91d9436f7e9bdc8b244444f511f0ffb9560d7446d2132903477751724c24f5
-
SSDEEP
196608:HGzErOAvYMg2gO1wjcjOJCx9zFajuc0diN+O3L0B4NoRgLRhwzCpJXd3mIqN2sqx:mzyqN4wLJCBLliNZ70ERmgJN3mH
Malware Config
Signatures
-
DarkVNC payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3892-1071-0x0000000000400000-0x0000000000488000-memory.dmp darkvnc behavioral2/memory/3892-1081-0x0000000000400000-0x0000000000488000-memory.dmp darkvnc behavioral2/memory/3200-1083-0x0000000000300000-0x00000000003C9000-memory.dmp darkvnc -
Executes dropped EXE 2 IoCs
Processes:
whileemploy_1.exewhileemploy_1.exepid process 4108 whileemploy_1.exe 3892 whileemploy_1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
whileemploy_1.exewhileemploy_1.exedescription pid process target process PID 4108 set thread context of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 3892 set thread context of 3200 3892 whileemploy_1.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
whileemploy_1.exepid process 3892 whileemploy_1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
whileemploy_1.exedescription pid process Token: SeDebugPrivilege 4108 whileemploy_1.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exewhileemploy_1.exewhileemploy_1.exedescription pid process target process PID 1900 wrote to memory of 4108 1900 SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe whileemploy_1.exe PID 1900 wrote to memory of 4108 1900 SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe whileemploy_1.exe PID 1900 wrote to memory of 4108 1900 SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 4108 wrote to memory of 3892 4108 whileemploy_1.exe whileemploy_1.exe PID 3892 wrote to memory of 3200 3892 whileemploy_1.exe svchost.exe PID 3892 wrote to memory of 3200 3892 whileemploy_1.exe svchost.exe PID 3892 wrote to memory of 3200 3892 whileemploy_1.exe svchost.exe PID 3892 wrote to memory of 3200 3892 whileemploy_1.exe svchost.exe PID 3892 wrote to memory of 3200 3892 whileemploy_1.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exeFilesize
12.2MB
MD5450d8900f699a7730d0219ab789fc7b2
SHA1713a63d0321c51b0c91347d407ece92d8800c0aa
SHA256383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1
SHA51282f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exeFilesize
12.2MB
MD5450d8900f699a7730d0219ab789fc7b2
SHA1713a63d0321c51b0c91347d407ece92d8800c0aa
SHA256383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1
SHA51282f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exeFilesize
12.2MB
MD5450d8900f699a7730d0219ab789fc7b2
SHA1713a63d0321c51b0c91347d407ece92d8800c0aa
SHA256383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1
SHA51282f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418
-
memory/3200-1083-0x0000000000300000-0x00000000003C9000-memory.dmpFilesize
804KB
-
memory/3200-1082-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/3892-1081-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/3892-1071-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/4108-173-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-181-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-147-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-149-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-151-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-153-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-155-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-157-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-159-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-161-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-163-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-165-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-167-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-169-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-171-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-143-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-175-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-177-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-179-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-145-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-183-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-185-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-187-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-189-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-191-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-193-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-195-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-197-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-199-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-201-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-203-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-205-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-1064-0x0000000006A10000-0x0000000006A11000-memory.dmpFilesize
4KB
-
memory/4108-142-0x0000000006870000-0x0000000006948000-memory.dmpFilesize
864KB
-
memory/4108-141-0x0000000006A70000-0x0000000006B02000-memory.dmpFilesize
584KB
-
memory/4108-140-0x00000000078E0000-0x0000000007E84000-memory.dmpFilesize
5.6MB
-
memory/4108-139-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4108-138-0x0000000000AC0000-0x0000000001704000-memory.dmpFilesize
12.3MB