Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10_x64 -
resource
win10 -
submitted
01-08-2020 19:33
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe
Resource
win10
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe
-
Size
345KB
-
MD5
b72e426691c8562cab3551f77964a8ff
-
SHA1
d2b2936ff183a895ce82ed5d75ea0fdac3c7591e
-
SHA256
bf2efbd13ace8761d0ff1d9e0952bbacb4c403a0e91d76d0b2cd65b838b4c0a6
-
SHA512
8a6f90aca560b56151ae047de87b44850133ec8605b9c66c71de9cfce57f4f3ae4a37d5f9b902085a5d7bdda718749f364fc5414581f9b1ca355c0c69dbde141
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll elysiumstealer_dll -
Loads dropped DLL 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exepid process 3844 SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3896 3844 WerFault.exe SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exeWerFault.exepid process 3844 SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3844 SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe Token: SeRestorePrivilege 3896 WerFault.exe Token: SeBackupPrivilege 3896 WerFault.exe Token: SeDebugPrivilege 3896 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.51343.32236.12600.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 20642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dllMD5
94173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798
-
memory/3896-5-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB