Analysis
-
max time kernel
191s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CrypterX-gen.501.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.CrypterX-gen.501.exe
Resource
win10v2004-20230915-en
General
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.501.exe
-
Size
400KB
-
MD5
fcbbe720928e4b5f3a30f9b407fa6874
-
SHA1
2ffd5a3a8feb1d28c6e527646cd91e8dd97e9f75
-
SHA256
0045fed5ccd3160d994bcf092af98d0e24e26fe1a05ab3a126881e032d1f938f
-
SHA512
e59d0e68965c1757c3ef4ea7ee94f15a68e4225d2d0264f9a665819798ba5b1decd9ce8734d509dc6fe5fe1098a076cd6f7d7dbd531c51572c18a9b40c8e15b9
-
SSDEEP
6144:SDAqFtOMBJN41P8LLH3p7n+K7Om2cNm7V3Fnm9HaOspiE:S1FtdBJW10HXpTZ7Omzm7Vm6OspX
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 api.ipify.org 53 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3028 set thread context of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 -
Program crash 1 IoCs
pid pid_target Process procid_target 2248 1944 WerFault.exe 93 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 1944 aspnet_compiler.exe 1944 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe Token: SeDebugPrivilege 1944 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1212 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 91 PID 3028 wrote to memory of 1212 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 91 PID 3028 wrote to memory of 1212 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 91 PID 3028 wrote to memory of 224 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 92 PID 3028 wrote to memory of 224 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 92 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93 PID 3028 wrote to memory of 1944 3028 SecuriteInfo.com.Win32.CrypterX-gen.501.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.501.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.501.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:1212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe"2⤵PID:224
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 19323⤵
- Program crash
PID:2248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1944 -ip 19441⤵PID:4700