Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.2451113759516605
Filename:	SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe
Filesize:	12880
MD5:	334400ebc61e0daf9c061d834fa2af6d
SHA1:	3a2af2dc7aa326e64a6f12e0785ad9cb79c3836e
SHA256:	cfdcd84dff934e67a5ff96ccb5911bbaff27191f96685d28a0f966972e7ad1b2
SHA512:	d26f78e181a511d8c40a7a467266b315543f02daec88eeebdc5608784a9c0eb8f592f8a3b7c5b5d50c8d2d4002ed6e4055d4f8448c6cfbf9c1ddeb5d80d4f14c
SSDEEP:	192:Yr8/SpWIUPptrzanL5uu2oEhZnpHzGoj6gnR22N:YrzpWIUPvz3E8ZpHzGovnN
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.3[.........."...0..............0... ...@....@.. ...............................R....@................................

Signature Hits	Behavior Group	Mitre Attack
Adds / modifies Windows certificates	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse usering and debugging	Anti Debugging
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses new MSVCR Dlls	Compliance, System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe.log
Category:	dropped
Dump:	SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.231548808556929
Encrypted:	false
Ssdeep:	6:Q3LadLC1HWN9Lx+OLC/7gc5+71OiOLCMM3RY9EZv47WsM3RLWJiv:Q3LaJVV+0kZs1B01ku9EZv4hk7v
Size:	388
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1080
Target ID:	0
Parent PID:	4004
Name:	SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe"
Size:	12880
MD5:	334400EBC61E0DAF9C061D834FA2AF6D
Time:	11:57:26
Date:	27/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xc50000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample reads its own file content	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t

unknown

https://sectigo.com/CPS0

unknown

http://ocsp.sectigo.com0

unknown

http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#

unknown

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Value name:	Blob
Value data:	04 00 00 00 01 00 00 00 10 00 00 00 49 79 04 B0 EB 87 19 AC 47 B0 BC 11 51 9B 74 D0 0F 00 00 00 01 00 00 00 14 00 00 00 3E 8E 64 87 F8 FD 27 D3 22 A2 69 A7 1E DA AC 5D 57 81 12 86 09 00 00 00 01 00 00 00 54 00 00 00 30 52 06 08 2B 06 01 05 05 07 03 02 06 08 2B 06 01 05 05 07 03 03 06 0A 2B 06 01 04 01 82 37 0A 03 04 06 08 2B 06 01 05 05 07 03 04 06 08 2B 06 01 05 05 07 03 06 06 08 2B 06 01 05 05 07 03 07 06 08 2B 06 01 05 05 07 03 01 06 08 2B 06 01 05 05 07 03 08 53 00 00 00 01 00 00 00 43 00 00 00 30 41 30 22 06 0C 2B 06 01 04 01 B2 31 01 02 01 05 01 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0 30 1B 06 05 67 81 0C 01 03 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0 62 00 00 00 01 00 00 00 20 00 00 00 D7 A7 A0 FB 5D 7E 27 31 D7 71 E9 48 4E BC DE F7 1D 5F 0C 3E 0A 29 48 78 2B C8 3E E0 EA 69 9E F4 0B 00 00 00 01 00 00 00 1C 00 00 00 53 00 65 00 63 00 74 00 69 00 67 00 6F 00 20 00 28 00 41 00 41 00 41 00 29 00 00 00 14 00 00 00 01 00 00 00 14 00 00 00 A0 11 0A 23 3E 96 F1 07 EC E2 AF 29 EF 82 A5 7F D0 30 A4 B4 1D 00 00 00 01 00 00 00 10 00 00 00 2E 0D 68 75 87 4A 44 C8 20 91 2E 85 E9 64 CF DB 03 00 00 00 01 00 00 00 14 00 00 00 D1 EB 23 A4 6D 17 D6 8F D9 25 64 C2 F1 F1 60 17 64 D8 E3 49 19 00 00 00 01 00 00 00 10 00 00 00 2A A1 C0 5E 2A E6 06 F1 98 C2 C5 E9 37 C9 7A A2 20 00 00 00 01 00 00 00 36 04 00 00 30 82 04 32 30 82 03 1A A0 03 02 01 02 02 01 01 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 7B 31 0B 30 09 06 03 55 04 06 13 02 47 42 31 1B 30 19 06 03 55 04 08 0C 12 47 72 65 61 74 65 72 20 4D 61 6E 63 68 65 73 74 65 72 31 10 30 0E 06 03 55 04 07 0C 07 53 61 6C 66 6F 72 64 31 1A 30 18 06 03 55 04 0A 0C 11 43 6F 6D 6F 64 6F 20 43 41 20 4C 69 6D 69 74 65 64 31 21 30 1F 06 03 55 04 03 0C 18 41 41 41 20 43 65 72 74 69 66 69 63 61 74 65 20 53 65 72 76 69 63 65 73 30 1E 17 0D 30 34 30 31 30 31 30 30 30 30 30 30 5A 17 0D 32 38 31 32 33 31 32 33 35 39 35 39 5A 30 7B 31 0B 30 09 06 03 55 04 06 13 02 47 42 31 1B 30 19 06 03 55 04 08 0C 12 47 72 65 61 74 65 72 20 4D 61 6E 63 68 65 73 74 65 72 31 10 30 0E 06 03 55 04 07 0C 07 53 61 6C 66 6F 72 64 31 1A 30 18 06 03 55 04 0A 0C 11 43 6F 6D 6F 64 6F 20 43 41 20 4C 69 6D 69 74 65 64 31 21 30 1F 06 03 55 04 03 0C 18 41 41 41 20 43 65 72 74 69 66 69 63 61 74 65 20 53 65 72 76 69 63 65 73 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 BE 40 9D F4 6E E1 EA 76 87 1C 4D 45 44 8E BE 46 C8 83 06 9D C1 2A FE 18 1F 8E E4 02 FA F3 AB 5D 50 8A 16 31 0B 9A 06 D0 C5 70 22 CD 49 2D 54 63 CC B6 6E 68 46 0B 53 EA CB 4C 24 C0 BC 72 4E EA F1 15 AE F4 54 9A 12 0A C3 7A B2 33 60 E2 DA 89 55 F3 22 58 F3 DE DC CF EF 83 86 A2 8C 94 4F 9F 68 F2 98 90 46 84 27 C7 76 BF E3 CC 35 2C 8B 5E 07 64 65 82 C0 48 B0 A8 91 F9 61 9F 76 20 50 A8 91 C7 66 B5 EB 78 62 03 56 F0 8A 1A 13 EA 31 A3 1E A0 99 FD 38 F6 F6 27 32 58 6F 07 F5 6B B8 FB 14 2B AF B7 AA CC D6 63 5F 73 8C DA 05 99 A8 38 A8 CB 17 78 36 51 AC E9 9E F4 78 3A 8D CF 0F D9 42 E2 98 0C AB 2F 9F 0E 01 DE EF 9F 99 49 F1 2D DF AC 74 4D 1B 98 B5 47 C5 E5 29 D1 F9 90 18 C7 62 9C BE 83 C7 26 7B 3E 8A 25 C7 C0 DD 9D E6 35 68 10 20 9D 8F D8 DE D2 C3 84 9C 0D 5E E8 2F C9 02 03 01 00 01 A3 81 C0 30 81 BD 30 1D 06 03 55 1D 0E 04 16 04 14 A0 11 0A 23 3E 96 F1 07 EC E2 AF 29 EF 82 A5 7F D0 30 A4 B4 30 0E 06 03 55 1D 0F 01 01 FF 04 04 03 02 01 06 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 7B 06 03 55 1D 1F 04 74 30 72 30 38 A0 36 A0 34 86 32 68 74 74 70 3A 2F 2F 63 72 6C 2E 63 6F 6D 6F 64 6F 63 61 2E 63 6F 6D 2F 41 41 41 43 65 72 74 69 66 69 63 61 74 65 53 65 72 76 69 63 65 73 2E 63 72 6C 30 36 A0 34 A0 32 86 30 68 74 74 70 3A 2F 2F 63 72 6C 2E 63 6F 6D 6F 64 6F 2E 6E 65 74 2F 41 41 41 43 65 72 74 69 66 69 63 61 74 65 53 65 72 76 69 63 65 73 2E 63 72 6C 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 01 01 00 08 56 FC 02 F0 9B E8 FF A4 FA D6 7B C6 44 80 CE 4F C4 C5 F6 00 58 CC A6 B6 BC 14 49 68 04 76 E8 E6 EE 5D EC 02 0F 60 D6 8D 50 18 4F 26 4E 01 E3 E6 B0 A5 EE BF BC 74 54 41 BF FD FC 12 B8 C7 4F 5A F4 89 60 05 7F 60 B7 05 4A F3 F6 F1 C2 BF C4 B9 74 86 B6 2D 7D 6B CC D2 F3 46 DD 2F C6 E0 6A C3 C3 34 03 2C 7D 96 DD 5A C2 0E A7 0A 99 C1 05 8B AB 0C 2F F3 5C 3A CF 6C 37 55 09 87 DE 53 40 6C 58 EF FC B6 AB 65 6E 04 F6 1B DC 3C E0 5A 15 C6 9E D9 F1 59 48 30 21 65 03 6C EC E9 21 73 EC 9B 03 A1 E0 37 AD A0 15 18 8F FA BA 02 CE A7 2C A9 10 13 2C D4 E5 08 26 AB 22 97 60 F8 90 5E 74 D4 A2 9A 53 BD F2 A9 68 E0 A2 6E C2 D7 6C B1 A3 0F 9E BF EB 68 E7 56 F2 AE F2 E3 2B 38 3A 09 81 B5 6B 85 D7 BE 2D ED 3F 1A B7 B2 63 E2 F5 62 2C 82 D4 6A 00 41 50 F1 39 83 9F 95 E9 36 96 98 6E

Signature Hits	Behavior Group	Mitre Attack
Adds / modifies Windows certificates	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Value name:	Blob
Value data:	5C 00 00 00 01 00 00 00 04 00 00 00 00 08 00 00 19 00 00 00 01 00 00 00 10 00 00 00 2A A1 C0 5E 2A E6 06 F1 98 C2 C5 E9 37 C9 7A A2 03 00 00 00 01 00 00 00 14 00 00 00 D1 EB 23 A4 6D 17 D6 8F D9 25 64 C2 F1 F1 60 17 64 D8 E3 49 1D 00 00 00 01 00 00 00 10 00 00 00 2E 0D 68 75 87 4A 44 C8 20 91 2E 85 E9 64 CF DB 14 00 00 00 01 00 00 00 14 00 00 00 A0 11 0A 23 3E 96 F1 07 EC E2 AF 29 EF 82 A5 7F D0 30 A4 B4 0B 00 00 00 01 00 00 00 1C 00 00 00 53 00 65 00 63 00 74 00 69 00 67 00 6F 00 20 00 28 00 41 00 41 00 41 00 29 00 00 00 62 00 00 00 01 00 00 00 20 00 00 00 D7 A7 A0 FB 5D 7E 27 31 D7 71 E9 48 4E BC DE F7 1D 5F 0C 3E 0A 29 48 78 2B C8 3E E0 EA 69 9E F4 53 00 00 00 01 00 00 00 43 00 00 00 30 41 30 22 06 0C 2B 06 01 04 01 B2 31 01 02 01 05 01 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0 30 1B 06 05 67 81 0C 01 03 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0 09 00 00 00 01 00 00 00 54 00 00 00 30 52 06 08 2B 06 01 05 05 07 03 02 06 08 2B 06 01 05 05 07 03 03 06 0A 2B 06 01 04 01 82 37 0A 03 04 06 08 2B 06 01 05 05 07 03 04 06 08 2B 06 01 05 05 07 03 06 06 08 2B 06 01 05 05 07 03 07 06 08 2B 06 01 05 05 07 03 01 06 08 2B 06 01 05 05 07 03 08 0F 00 00 00 01 00 00 00 14 00 00 00 3E 8E 64 87 F8 FD 27 D3 22 A2 69 A7 1E DA AC 5D 57 81 12 86 04 00 00 00 01 00 00 00 10 00 00 00 49 79 04 B0 EB 87 19 AC 47 B0 BC 11 51 9B 74 D0 20 00 00 00 01 00 00 00 36 04 00 00 30 82 04 32 30 82 03 1A A0 03 02 01 02 02 01 01 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 7B 31 0B 30 09 06 03 55 04 06 13 02 47 42 31 1B 30 19 06 03 55 04 08 0C 12 47 72 65 61 74 65 72 20 4D 61 6E 63 68 65 73 74 65 72 31 10 30 0E 06 03 55 04 07 0C 07 53 61 6C 66 6F 72 64 31 1A 30 18 06 03 55 04 0A 0C 11 43 6F 6D 6F 64 6F 20 43 41 20 4C 69 6D 69 74 65 64 31 21 30 1F 06 03 55 04 03 0C 18 41 41 41 20 43 65 72 74 69 66 69 63 61 74 65 20 53 65 72 76 69 63 65 73 30 1E 17 0D 30 34 30 31 30 31 30 30 30 30 30 30 5A 17 0D 32 38 31 32 33 31 32 33 35 39 35 39 5A 30 7B 31 0B 30 09 06 03 55 04 06 13 02 47 42 31 1B 30 19 06 03 55 04 08 0C 12 47 72 65 61 74 65 72 20 4D 61 6E 63 68 65 73 74 65 72 31 10 30 0E 06 03 55 04 07 0C 07 53 61 6C 66 6F 72 64 31 1A 30 18 06 03 55 04 0A 0C 11 43 6F 6D 6F 64 6F 20 43 41 20 4C 69 6D 69 74 65 64 31 21 30 1F 06 03 55 04 03 0C 18 41 41 41 20 43 65 72 74 69 66 69 63 61 74 65 20 53 65 72 76 69 63 65 73 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 BE 40 9D F4 6E E1 EA 76 87 1C 4D 45 44 8E BE 46 C8 83 06 9D C1 2A FE 18 1F 8E E4 02 FA F3 AB 5D 50 8A 16 31 0B 9A 06 D0 C5 70 22 CD 49 2D 54 63 CC B6 6E 68 46 0B 53 EA CB 4C 24 C0 BC 72 4E EA F1 15 AE F4 54 9A 12 0A C3 7A B2 33 60 E2 DA 89 55 F3 22 58 F3 DE DC CF EF 83 86 A2 8C 94 4F 9F 68 F2 98 90 46 84 27 C7 76 BF E3 CC 35 2C 8B 5E 07 64 65 82 C0 48 B0 A8 91 F9 61 9F 76 20 50 A8 91 C7 66 B5 EB 78 62 03 56 F0 8A 1A 13 EA 31 A3 1E A0 99 FD 38 F6 F6 27 32 58 6F 07 F5 6B B8 FB 14 2B AF B7 AA CC D6 63 5F 73 8C DA 05 99 A8 38 A8 CB 17 78 36 51 AC E9 9E F4 78 3A 8D CF 0F D9 42 E2 98 0C AB 2F 9F 0E 01 DE EF 9F 99 49 F1 2D DF AC 74 4D 1B 98 B5 47 C5 E5 29 D1 F9 90 18 C7 62 9C BE 83 C7 26 7B 3E 8A 25 C7 C0 DD 9D E6 35 68 10 20 9D 8F D8 DE D2 C3 84 9C 0D 5E E8 2F C9 02 03 01 00 01 A3 81 C0 30 81 BD 30 1D 06 03 55 1D 0E 04 16 04 14 A0 11 0A 23 3E 96 F1 07 EC E2 AF 29 EF 82 A5 7F D0 30 A4 B4 30 0E 06 03 55 1D 0F 01 01 FF 04 04 03 02 01 06 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 7B 06 03 55 1D 1F 04 74 30 72 30 38 A0 36 A0 34 86 32 68 74 74 70 3A 2F 2F 63 72 6C 2E 63 6F 6D 6F 64 6F 63 61 2E 63 6F 6D 2F 41 41 41 43 65 72 74 69 66 69 63 61 74 65 53 65 72 76 69 63 65 73 2E 63 72 6C 30 36 A0 34 A0 32 86 30 68 74 74 70 3A 2F 2F 63 72 6C 2E 63 6F 6D 6F 64 6F 2E 6E 65 74 2F 41 41 41 43 65 72 74 69 66 69 63 61 74 65 53 65 72 76 69 63 65 73 2E 63 72 6C 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 01 01 00 08 56 FC 02 F0 9B E8 FF A4 FA D6 7B C6 44 80 CE 4F C4 C5 F6 00 58 CC A6 B6 BC 14 49 68 04 76 E8 E6 EE 5D EC 02 0F 60 D6 8D 50 18 4F 26 4E 01 E3 E6 B0 A5 EE BF BC 74 54 41 BF FD FC 12 B8 C7 4F 5A F4 89 60 05 7F 60 B7 05 4A F3 F6 F1 C2 BF C4 B9 74 86 B6 2D 7D 6B CC D2 F3 46 DD 2F C6 E0 6A C3 C3 34 03 2C 7D 96 DD 5A C2 0E A7 0A 99 C1 05 8B AB 0C 2F F3 5C 3A CF 6C 37 55 09 87 DE 53 40 6C 58 EF FC B6 AB 65 6E 04 F6 1B DC 3C E0 5A 15 C6 9E D9 F1 59 48 30 21 65 03 6C EC E9 21 73 EC 9B 03 A1 E0 37 AD A0 15 18 8F FA BA 02 CE A7 2C A9 10 13 2C D4 E5 08 26 AB 22 97 60 F8 90 5E 74 D4 A2 9A 53 BD F2 A9 68 E0 A2 6E C2 D7 6C B1 A3 0F 9E BF EB 68 E7 56 F2 AE F2 E3 2B 38 3A 09 81 B5 6B 85 D7 BE 2D ED 3F 1A B7 B2 63 E2 F5 62 2C 82 D4 6A 00 41 50 F1 39 83 9F 95 E9 36 96 98 6E

Signature Hits	Behavior Group	Mitre Attack
Adds / modifies Windows certificates	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools

Memdumps

Base Address

Regiontype

Protect

Malicious

7FFD33D1F000

trusted library allocation

page execute and read and write

1773000

heap

page read and write

7FFD33D02000

trusted library allocation

page execute and read and write

17A6000

heap

page read and write

C54000

unkown

page readonly

7FFD33E40000

trusted library allocation

page execute and read and write

1430000

heap

page read and write

1C4BE000

stack

page read and write

167E000

stack

page read and write

7FFD33DBA000

trusted library allocation

page execute and read and write

7FFD33DF2000

trusted library allocation

page execute and read and write

1BEC0000

heap

page read and write

1710000

heap

page read and write

1C1BE000

stack

page read and write

1339B000

trusted library allocation

page read and write

7FFD33CF2000

trusted library allocation

page execute and read and write

7FFD33D0A000

trusted library allocation

page execute and read and write

C50000

unkown

page readonly

1130000

heap

page read and write

C50000

unkown

page readonly

13391000

trusted library allocation

page read and write

13D5000

trusted library allocation

page read and write

C52000

unkown

page readonly

7FFD33DB2000

trusted library allocation

page execute and read and write

122A000

heap

page read and write

13F0000

trusted library allocation

page read and write

1BDB0000

heap

page read and write

11CD000

heap

page read and write

13D0000

trusted library allocation

page read and write

7FF4B2800000

trusted library allocation

page execute and read and write

13398000

trusted library allocation

page read and write

D96000

stack

page read and write

304E000

stack

page read and write

7FF4B27F0000

trusted library allocation

page execute and read and write

138E000

stack

page read and write

1470000

heap

page read and write

3391000

trusted library allocation

page read and write

1BD6E000

stack

page read and write

13F4000

trusted library allocation

page read and write

1435000

heap

page read and write

1BFC0000

heap

page read and write

16D0000

heap

page execute and read and write

7FFD33DCA000

trusted library allocation

page execute and read and write

7FFD33D54000

trusted library allocation

page execute and read and write

10D0000

heap

page read and write

11C2000

heap

page read and write

7FFD33D23000

trusted library allocation

page execute and read and write

7FFD33DC0000

trusted library allocation

page read and write

17A3000

heap

page read and write

10F0000

heap

page read and write

1190000

heap

page read and write

7FFD33DCD000

trusted library allocation

page execute and read and write

1110000

heap

page read and write

1770000

heap

page read and write

13395000

trusted library allocation

page read and write

1BEBE000

stack

page read and write

7FFD33D05000

trusted library allocation

page execute and read and write

143C000

heap

page read and write

1E20E000

stack

page read and write

1D910000

trusted library allocation

page read and write

1E30E000

stack

page read and write

1C3BE000

stack

page read and write

17A0000

heap

page read and write

1228000

heap

page read and write

119C000

heap

page read and write

13DA000

trusted library allocation

page read and write

DE0000

heap

page read and write

128B000

heap

page read and write

7FFD33E32000

trusted library allocation

page read and write

157E000

stack

page read and write

1BC6C000

stack

page read and write

13DD000

trusted library allocation

page read and write

1475000

heap

page read and write

1C2BE000

stack

page read and write

20000

trusted library allocation

page read and write

1BF20000

heap

page read and write

11BF000

heap

page read and write

There are 67 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe

Files

Processes

URLs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe

Files

Processes

URLs

Registry

Memdumps

IOC Report
SecuriteInfo.com.Trojan.GenericKD.74343100.23730.20084.exe