d68bfd59c3db0b1e61fc5d88cccc6ed26da7bf1ce62dec8b7e820b2d0df77fb6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
Size

808KB
MD5

9417de6917947e9ef5381fb5a9e7abeb
SHA1

ad4d1fb795bfab1ca56a182d64b5b6d5ba7783ef
SHA256

d68bfd59c3db0b1e61fc5d88cccc6ed26da7bf1ce62dec8b7e820b2d0df77fb6
SHA512

bed01456efb30b28e12624f4d1665467637aa1672581f159ba37b56fdc6a9b5e186fc818b4a83e5706333e4e3dd86e862a97a0a0b89a2ea2b99611f3a377088b
SSDEEP

12288:Nd8ETzeyxJtgR0rlsgw09HSYeMJIPU6QNsI9MPL3pO+GtGUFMbOz9SVDQpS:jRtZlsgw09yYzIPUPqA+JUqhVDQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2812	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	28
PID 2508 wrote to memory of 2812	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	28
PID 2508 wrote to memory of 2812	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	28
PID 2508 wrote to memory of 2812	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	28
PID 2508 wrote to memory of 2816	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	29
PID 2508 wrote to memory of 2816	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	29
PID 2508 wrote to memory of 2816	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	29
PID 2508 wrote to memory of 2816	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	29
PID 2508 wrote to memory of 2756	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	30
PID 2508 wrote to memory of 2756	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	30
PID 2508 wrote to memory of 2756	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	30
PID 2508 wrote to memory of 2756	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	30
PID 2508 wrote to memory of 2724	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	31
PID 2508 wrote to memory of 2724	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	31
PID 2508 wrote to memory of 2724	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	31
PID 2508 wrote to memory of 2724	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	31
PID 2508 wrote to memory of 2692	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	32
PID 2508 wrote to memory of 2692	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	32
PID 2508 wrote to memory of 2692	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	32
PID 2508 wrote to memory of 2692	2508	SecuriteInfo.com.Trojan.PackedNET.2591.588.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
  2⤵
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2591.588.exe"
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-1-0x0000000074C70000-0x000000007535E000-memory.dmp

Filesize
6.9MB

Download
memory/2508-0-0x0000000000360000-0x0000000000430000-memory.dmp

Filesize
832KB

Download
memory/2508-2-0x00000000020E0000-0x0000000002120000-memory.dmp

Filesize
256KB

Download
memory/2508-3-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/2508-4-0x0000000000490000-0x000000000049E000-memory.dmp

Filesize
56KB

Download
memory/2508-5-0x0000000005D30000-0x0000000005DC0000-memory.dmp

Filesize
576KB

Download
memory/2508-6-0x0000000074C70000-0x000000007535E000-memory.dmp

Filesize
6.9MB

Download