Overview

overview

10

Static

static

SecuriteIn...02.exe

windows7_x64

10

SecuriteIn...02.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    01-08-2020 19:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Siggen9.58380.16060.15702.exe

  • Size

    405KB

  • MD5

    421b08e81a183c1d7337128cba971fa2

  • SHA1

    291bab40915a7c2d7277f3f1944e54a3c236eef2

  • SHA256

    cf5d63823cb7e280e555b94cba5aa1a5e8c0eb3c738f7e620dc2a923532f98de

  • SHA512

    97bbe1cd8793b82ac2b24cd73a959ee1be86b2491d5552dd264c4e0270fd1e2d34adfe4afe2b234c577ca179c7812548978357184abc84a2bf0966e50e907b5c

Score
10/10
ratevasiontrojanspywarestealerformbookpersistence

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Formbook Payload 4 IoCs
    rat
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 110 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.58380.16060.15702.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.58380.16060.15702.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1424
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetThreadContext
          PID:1428
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:872
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:1012
          • C:\Windows\SysWOW64\autofmt.exe
            "C:\Windows\SysWOW64\autofmt.exe"
            2⤵
              PID:1008
            • C:\Windows\SysWOW64\autofmt.exe
              "C:\Windows\SysWOW64\autofmt.exe"
              2⤵
                PID:1620
              • C:\Windows\SysWOW64\autofmt.exe
                "C:\Windows\SysWOW64\autofmt.exe"
                2⤵
                  PID:1616
                • C:\Windows\SysWOW64\autofmt.exe
                  "C:\Windows\SysWOW64\autofmt.exe"
                  2⤵
                    PID:792
                  • C:\Windows\SysWOW64\autofmt.exe
                    "C:\Windows\SysWOW64\autofmt.exe"
                    2⤵
                      PID:328
                    • C:\Windows\SysWOW64\autofmt.exe
                      "C:\Windows\SysWOW64\autofmt.exe"
                      2⤵
                        PID:748
                      • C:\Windows\SysWOW64\autofmt.exe
                        "C:\Windows\SysWOW64\autofmt.exe"
                        2⤵
                          PID:1088
                        • C:\Windows\SysWOW64\autofmt.exe
                          "C:\Windows\SysWOW64\autofmt.exe"
                          2⤵
                            PID:1632
                          • C:\Windows\SysWOW64\autofmt.exe
                            "C:\Windows\SysWOW64\autofmt.exe"
                            2⤵
                              PID:1076
                            • C:\Windows\SysWOW64\autofmt.exe
                              "C:\Windows\SysWOW64\autofmt.exe"
                              2⤵
                                PID:1056
                              • C:\Windows\SysWOW64\autoconv.exe
                                "C:\Windows\SysWOW64\autoconv.exe"
                                2⤵
                                  PID:1536
                                • C:\Windows\SysWOW64\chkdsk.exe
                                  "C:\Windows\SysWOW64\chkdsk.exe"
                                  2⤵
                                  • System policy modification
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Drops file in Program Files directory
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetThreadContext
                                  • Adds policy Run key to start application
                                  • Enumerates system info in registry
                                  • Suspicious use of WriteProcessMemory
                                  PID:1524
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    3⤵
                                      PID:1828
                                    • C:\Program Files\Mozilla Firefox\Firefox.exe
                                      "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                      3⤵
                                        PID:1568

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Initial Access

                                  Execution

                                  Persistence

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1060

                                  Privilege Escalation

                                  Defense Evasion

                                  Modify Registry

                                  3
                                  T1112

                                  Credential Access

                                  Credentials in Files

                                  1
                                  T1081

                                  Discovery

                                  System Information Discovery

                                  2
                                  T1082

                                  Query Registry

                                  1
                                  T1012

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Exfiltration

                                  Command and Control

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Roaming\JN004T3S\JN0logim.jpeg
                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\JN004T3S\JN0logrf.ini
                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\JN004T3S\JN0logri.ini
                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\JN004T3S\JN0logrv.ini
                                    Download Submit
                                  • memory/1428-0-0x0000000000400000-0x000000000042D000-memory.dmp
                                    Filesize

                                    180KB

                                    Download
                                  • memory/1428-1-0x000000000041E2F0-mapping.dmp
                                    Download
                                  • memory/1524-6-0x0000000075D70000-0x0000000075D7C000-memory.dmp
                                    Filesize

                                    48KB

                                    Download
                                  • memory/1524-7-0x00000000760B0000-0x00000000761CD000-memory.dmp
                                    Filesize

                                    1.1MB

                                    Download
                                  • memory/1524-8-0x00000000033D0000-0x0000000003480000-memory.dmp
                                    Filesize

                                    704KB

                                    Download
                                  • memory/1524-5-0x00000000030C0000-0x0000000003225000-memory.dmp
                                    Filesize

                                    1.4MB

                                    Download
                                  • memory/1524-3-0x0000000000DD0000-0x0000000000DD7000-memory.dmp
                                    Filesize

                                    28KB

                                    Download
                                  • memory/1524-2-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1568-9-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1568-10-0x000000013F580000-0x000000013F613000-memory.dmp
                                    Filesize

                                    588KB

                                    Download
                                  • memory/1828-4-0x0000000000000000-mapping.dmp
                                    Download