becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789

Analysis

max time kernel
118s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 14:55

Target

SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
Size

861KB
MD5

62f0e84a989f520db3b1463e02b24a91
SHA1

25af81908bfa58bee6d7eb704504d270fa612e44
SHA256

becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
SHA512

f4d29e7d2b15a8284c8ee834b076143e3884df9a5afac1342ca8d647f2a5c858bcb11357a55ba6da9f3137a63831aecb8aa49f775d1c7793220059bee16c36f4
SSDEEP

12288:J8/kSMdr3GNUAn9cNNeX8X/iTS46omhPw7tquxyR6VXzgRwGuwcwBTuiCnTKqUL0:J8PquxyR6VwuwcwYDELVmxVL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
2688	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
2688	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4940	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	89
PID 4680 wrote to memory of 4940	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	89
PID 4680 wrote to memory of 4940	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	89
PID 4680 wrote to memory of 1656	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	91
PID 4680 wrote to memory of 1656	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	91
PID 4680 wrote to memory of 1656	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	91
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90
PID 4680 wrote to memory of 2688	4680	SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe	90

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe"
  2⤵
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.exe"
  2⤵
  PID:1656

memory/2688-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2688-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2688-15-0x0000000001020000-0x000000000136A000-memory.dmp

Filesize
3.3MB

Download
memory/4680-4-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4680-0-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4680-5-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4680-6-0x0000000005390000-0x000000000539A000-memory.dmp

Filesize
40KB

Download
memory/4680-7-0x0000000005750000-0x0000000005768000-memory.dmp

Filesize
96KB

Download
memory/4680-8-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4680-9-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/4680-10-0x000000000AA80000-0x000000000AAFA000-memory.dmp

Filesize
488KB

Download
memory/4680-11-0x000000000DBA0000-0x000000000DC3C000-memory.dmp

Filesize
624KB

Download
memory/4680-3-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download
memory/4680-14-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4680-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/4680-1-0x00000000008E0000-0x00000000009BE000-memory.dmp

Filesize
888KB

Download