Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 10:39
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Resource
win10v2004-20241007-en
General
-
Target
SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
-
Size
214KB
-
MD5
f32e47eeab5658904b67a491c4c08a39
-
SHA1
11661085721eaa76651e7132f4e4ff36722f7ea4
-
SHA256
0bda73349659b682a08172de94196235b902784d74457d3cd837aa47f16144f8
-
SHA512
7ce6a0111c55ef9403d32d042e333baeb447bd72b8964b3b96fd31639c4d3a9ded955645f89e78921887dc36d5bb9277e2072c70fd03d49dd7a2d3484abb1c45
-
SSDEEP
3072:taDgZcejNH8Q24LTOgxIAZlqH1U21uURyFFtRDeAg0FujU4Vlexh:tXjjt8wHxJqVU2Dg/eAOoGMh
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2856 2872 SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe 31 PID 2872 wrote to memory of 2856 2872 SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe 31 PID 2872 wrote to memory of 2856 2872 SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe 31 PID 2872 wrote to memory of 2856 2872 SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
- System Location Discovery: System Language Discovery
PID:2856
-