6ebccee754ae0066c0b1687793eb8478e90d0ce2f581ff175dc9f85cead5a8af

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 02:25

Target
SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe
Size 29.4MB
Sample240328-cwajaaag73
SHA256 6ebccee754ae0066c0b1687793eb8478e90d0ce2f581ff175dc9f85cead5a8af
MD5 6a125563df3ce37fcc9fd74728577523
SHA1 aed0179bf2af022ca0f7ec5fc62010b5c38e0998
SHA512 06e8a7620e380d760da7a4b9a86f549aea0dc5aa9c32d91a40ff2c9ecb1395ef321ee21e482f948db813bc20e27fc788f2436a2ef43abc3de3cfeaa7509e384e
SSDEEP 393216:mEaEfX3TUOH80BMUUpKn47KKE2ZpVMjB67vfy3QjI0xfwYrMUn4sLh/OHydHPxl:mEaEP3TUSMU+KCZHMj33mrVwYQsLb3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2292	SecuriteInfo.com.BACKDOOR.Trojan.31932.269.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 2292	464	SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe	89
PID 464 wrote to memory of 2292	464	SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe	89
PID 464 wrote to memory of 2292	464	SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\is-NGHHK.tmp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NGHHK.tmp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.tmp" /SL5="$B004C,30575391,58368,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.exe"
  2⤵
  - Executes dropped EXE
  PID:2292

SecuriteInfo.com.BACKDOOR.Trojan.31932.269.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NGHHK.tmp\SecuriteInfo.com.BACKDOOR.Trojan.31932.269.tmp
Size 702KB
SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
MD5 1afbd25db5c9a90fe05309f7c4fbcf09
SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/464-2-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/464-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2292-6-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/2292-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2292-12-0x0000000000760000-0x0000000000761000-memory.dmp

Download