e5d73714c09ee0fe864523ce30b3bd1a77190adedd278861df0a3ba22bea2d9f

General

Target

SecuriteInfo.com.Win32.Herz.B.21271.15275.exe
Size

855KB
MD5

4141eca3c3f8fef9dd9386f5a97d1730
SHA1

0dcdf961da9fe9e4b3e1e70895a9e3bea43b8487
SHA256

e5d73714c09ee0fe864523ce30b3bd1a77190adedd278861df0a3ba22bea2d9f
SHA512

9653de22a4a22e53e5c76a62dbcdfd1e67c40e61d172b085afd1bdd4e14505e70726a4a452f78865a8e2f0e7cda2589de65cd580749488758b8e39ce733e923a

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

568 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
568	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Win32.Herz.B.21271.15275.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1192 PING.EXE

pid	process
1192	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Win32.Herz.B.21271.15275.execmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 568	1744	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe	cmd.exe
PID 1744 wrote to memory of 568	1744	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe	cmd.exe
PID 1744 wrote to memory of 568	1744	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe	cmd.exe
PID 1744 wrote to memory of 568	1744	SecuriteInfo.com.Win32.Herz.B.21271.15275.exe	cmd.exe
PID 568 wrote to memory of 1192	568	cmd.exe	PING.EXE
PID 568 wrote to memory of 1192	568	cmd.exe	PING.EXE
PID 568 wrote to memory of 1192	568	cmd.exe	PING.EXE
PID 568 wrote to memory of 1192	568	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Herz.B.21271.15275.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Herz.B.21271.15275.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Herz.B.21271.15275.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-1-0x0000000000000000-mapping.dmp

Download
memory/1192-2-0x0000000000000000-mapping.dmp

Download
memory/1664-0-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing