Resubmissions
30-11-2023 18:29
231130-w41vzsga41 10Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
30-11-2023 18:29
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RansomX-gen.10015.exe
Resource
win7-20231025-en
windows7-x64
5 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win32.RansomX-gen.10015.exe
-
Size
1.3MB
-
MD5
5a66a38c855bee6f87fb1521e01f99ca
-
SHA1
a9fd0918d1b5860a10b758ff530e3702b5fdb922
-
SHA256
1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94
-
SHA512
a3fde1b6c0e5fbb8822cb63be4b50c4050f3f713db3d26df1f1f85ee8c3cad95cd5146a172eef3c3532a547deacc80b2d46cc2e439ef0d2714bcbfc46cf8a73f
-
SSDEEP
24576:t5hPzLxxyJR6Xb2cacy6eCE9eRDVNUHs8V3ZkUAHa06L8gP:tHLLx4R8zZms7UA1gP
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
resource yara_rule behavioral1/memory/2236-1-0x0000000000FC0000-0x000000000111E000-memory.dmp family_purelogs -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 2020 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 29 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 1764 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 30 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2676 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 31 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2664 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 32 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2644 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 33 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2972 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 34 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2752 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 35 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2756 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 36 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2816 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 37 PID 2236 wrote to memory of 2824 2236 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10015.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10015.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:1764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2676
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2644
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2824
-