Analysis
-
max time kernel
26s -
max time network
46s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-03-2021 14:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe
-
Size
1.9MB
-
MD5
c7df9293a3b926e11a4ede7aeedd5c58
-
SHA1
86ccae3e5b2b67b6d6758554ea57cbd4d66be034
-
SHA256
07967e861e991eabea5649e7e6de840028a2b217d2a9f354315c9b8f25e34068
-
SHA512
7f308d46f30b7197955e522afdaa508f7e302cb5525c33dae4f27eff56f3b20c618763ee68516c745d6ec4e94a356b043c2ccbd47e20badeccb904f2d4b785ba
Malware Config
Extracted
raccoon
aef61793e586ca15c24106ac17a2a83a30fb0a25
-
url4cnc
https://tttttt.me/h_scroogenews_1
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 1652 AddInProcess32.exe -
Loads dropped DLL 8 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exeWerFault.exepid process 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exedescription pid process target process PID 784 set thread context of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1512 1652 WerFault.exe AddInProcess32.exe -
Processes:
AddInProcess32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 AddInProcess32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exeWerFault.exepid process 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exeWerFault.exedescription pid process Token: SeDebugPrivilege 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe Token: SeDebugPrivilege 1512 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exeAddInProcess32.exedescription pid process target process PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 784 wrote to memory of 1652 784 SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe AddInProcess32.exe PID 1652 wrote to memory of 1512 1652 AddInProcess32.exe WerFault.exe PID 1652 wrote to memory of 1512 1652 AddInProcess32.exe WerFault.exe PID 1652 wrote to memory of 1512 1652 AddInProcess32.exe WerFault.exe PID 1652 wrote to memory of 1512 1652 AddInProcess32.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61833.4196.20708.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 8883⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
memory/784-5-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/784-3-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/784-11-0x0000000004C21000-0x0000000004C22000-memory.dmpFilesize
4KB
-
memory/784-2-0x0000000073D40000-0x000000007442E000-memory.dmpFilesize
6.9MB
-
memory/784-8-0x0000000000430000-0x000000000043B000-memory.dmpFilesize
44KB
-
memory/784-7-0x00000000049C0000-0x00000000049EF000-memory.dmpFilesize
188KB
-
memory/784-9-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/1512-17-0x0000000002150000-0x0000000002161000-memory.dmpFilesize
68KB
-
memory/1512-16-0x0000000000000000-mapping.dmp
-
memory/1512-27-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1652-13-0x000000000043FEA3-mapping.dmp
-
memory/1652-15-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1652-25-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB
-
memory/1652-12-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB