Overview

overview

10

Static

static

3

SecuriteIn...49.exe

windows7-x64

6

SecuriteIn...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSXgen.8851.12149.exe

  • Size

    1.7MB

  • Sample

    240920-dzatwswgnp

  • MD5

    2bc092cb35ec5ebbc91e3c51638c98f0

  • SHA1

    9600adb6a5d9cfb8a0dff5193e3cd4d12c201974

  • SHA256

    5ed9fba25533a9f8302ca94381841f832b17880f9b7cf6da1cbcd1a1a439183f

  • SHA512

    baae716296aa02d80e5c01d57b98491a7e73ead06702fa7dee43caef9855ddb6cb46778070bd6030f819c95b71d529285b79f39c3d092c17ba6cefd65bd24046

  • SSDEEP

    49152:9ql8HT3DOOR3yAYLDsQjPeGzS4fm1GYc/v/o0Yvv1dgs:9ql8HTiQCxpj2GO+H3ApPg

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.PWSXgen.8851.12149.exe

    • Size

      1.7MB

    • MD5

      2bc092cb35ec5ebbc91e3c51638c98f0

    • SHA1

      9600adb6a5d9cfb8a0dff5193e3cd4d12c201974

    • SHA256

      5ed9fba25533a9f8302ca94381841f832b17880f9b7cf6da1cbcd1a1a439183f

    • SHA512

      baae716296aa02d80e5c01d57b98491a7e73ead06702fa7dee43caef9855ddb6cb46778070bd6030f819c95b71d529285b79f39c3d092c17ba6cefd65bd24046

    • SSDEEP

      49152:9ql8HT3DOOR3yAYLDsQjPeGzS4fm1GYc/v/o0Yvv1dgs:9ql8HTiQCxpj2GO+H3ApPg

    Score
    10/10
    discoverypersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks