Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 23:54
General
-
Target
SecuriteInfo.com.Win32.MalwareX-gen.24360.exe
-
Size
1.1MB
-
MD5
df382f435105a373a1f392a397734ab5
-
SHA1
7ec2172e6603659f09351eb92a3cb86fba90be68
-
SHA256
8a7f1d7c33eadcfeec65ceb4636a266c41dbf0657ba21f0e7e9fdfa6cedee6d8
-
SHA512
7e1adb46f35a1b4f574f3874a127d06daa708fe67d8f4d0b1889c35507414dc40055da1a411bdd440812a0f2fff3f5b4479bd2f5128ef56b7b7bd5e4cb2e2a61
-
SSDEEP
24576:MqC3Hnl/Dcp9mNXc6ng/bDM2b9goS7pSvekd8:UXlLUIdhn8bvgWjK
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
ftp.code-jet.com - Port:
21 - Username:
[email protected] - Password:
4+i)Wf,h^zRm
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.24360.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.24360.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
704KB
-
Filesize
6.9MB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
1.1MB