Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 12:27
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll
-
Size
984KB
-
MD5
8b47ffc81cbf3b1ab3c4b291489b1a38
-
SHA1
47dd9368d3849f7c0e14873de001f9609f6b75dd
-
SHA256
de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d
-
SHA512
529bb98c8de389f29c407723d11c580f8b10b2bc7138b1e5d2aaff072f1287da930a603eee00ccd9f7643ddcc7e9121043b27c43c200a0a6a4cfd251abca25f2
-
SSDEEP
24576:sgvs07R4vjj0aYWQhGvAiGi772dZYOpBF:swF7N0MTdZYO
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 4 488 rundll32.exe 40 488 rundll32.exe 49 488 rundll32.exe 70 488 rundll32.exe 84 488 rundll32.exe 85 488 rundll32.exe 86 488 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/488-0-0x00000000748C0000-0x0000000074B49000-memory.dmp upx behavioral2/memory/488-1-0x00000000748C0000-0x0000000074B49000-memory.dmp upx behavioral2/memory/488-2-0x00000000748C0000-0x0000000074B49000-memory.dmp upx behavioral2/memory/488-13-0x00000000748C0000-0x0000000074B49000-memory.dmp upx behavioral2/memory/488-14-0x00000000748C0000-0x0000000074B49000-memory.dmp upx -
Processes:
rundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11000" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rundll32.exepid process 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe 488 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4112 wrote to memory of 488 4112 rundll32.exe rundll32.exe PID 4112 wrote to memory of 488 4112 rundll32.exe rundll32.exe PID 4112 wrote to memory of 488 4112 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll,#12⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/488-0-0x00000000748C0000-0x0000000074B49000-memory.dmpFilesize
2.5MB
-
memory/488-1-0x00000000748C0000-0x0000000074B49000-memory.dmpFilesize
2.5MB
-
memory/488-2-0x00000000748C0000-0x0000000074B49000-memory.dmpFilesize
2.5MB
-
memory/488-13-0x00000000748C0000-0x0000000074B49000-memory.dmpFilesize
2.5MB
-
memory/488-14-0x00000000748C0000-0x0000000074B49000-memory.dmpFilesize
2.5MB