Resubmissions
30-11-2023 18:29
231130-w41vzsga41 10Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2023 18:29
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RansomX-gen.10015.exe
Resource
win7-20231025-en
5 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win32.RansomX-gen.10015.exe
-
Size
1.3MB
-
MD5
5a66a38c855bee6f87fb1521e01f99ca
-
SHA1
a9fd0918d1b5860a10b758ff530e3702b5fdb922
-
SHA256
1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94
-
SHA512
a3fde1b6c0e5fbb8822cb63be4b50c4050f3f713db3d26df1f1f85ee8c3cad95cd5146a172eef3c3532a547deacc80b2d46cc2e439ef0d2714bcbfc46cf8a73f
-
SSDEEP
24576:t5hPzLxxyJR6Xb2cacy6eCE9eRDVNUHs8V3ZkUAHa06L8gP:tHLLx4R8zZms7UA1gP
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
resource yara_rule behavioral2/memory/4972-0-0x0000000000C20000-0x0000000000D7E000-memory.dmp family_purelogs -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4972 wrote to memory of 1788 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 86 PID 4972 wrote to memory of 1788 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 86 PID 4972 wrote to memory of 1788 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 86 PID 4972 wrote to memory of 1296 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 87 PID 4972 wrote to memory of 1296 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 87 PID 4972 wrote to memory of 1296 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 87 PID 4972 wrote to memory of 948 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 88 PID 4972 wrote to memory of 948 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 88 PID 4972 wrote to memory of 948 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 88 PID 4972 wrote to memory of 4316 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 90 PID 4972 wrote to memory of 4316 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 90 PID 4972 wrote to memory of 4316 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 90 PID 4972 wrote to memory of 4884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 89 PID 4972 wrote to memory of 4884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 89 PID 4972 wrote to memory of 4884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 89 PID 4972 wrote to memory of 3884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 91 PID 4972 wrote to memory of 3884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 91 PID 4972 wrote to memory of 3884 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 91 PID 4972 wrote to memory of 5072 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 95 PID 4972 wrote to memory of 5072 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 95 PID 4972 wrote to memory of 5072 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 95 PID 4972 wrote to memory of 3512 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 92 PID 4972 wrote to memory of 3512 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 92 PID 4972 wrote to memory of 3512 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 92 PID 4972 wrote to memory of 4264 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 94 PID 4972 wrote to memory of 4264 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 94 PID 4972 wrote to memory of 4264 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 94 PID 4972 wrote to memory of 4644 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 93 PID 4972 wrote to memory of 4644 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 93 PID 4972 wrote to memory of 4644 4972 SecuriteInfo.com.Win32.RansomX-gen.10015.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10015.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10015.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:1788
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:1296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:4884
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:4316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:3884
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:3512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:4644
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:4264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:5072
-