Analysis
- max time kernel
20s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/04/2021, 10:58
General
- Target SecuriteInfo.com.Trojan.PWS.Siggen2.28981.28903.1201.exe
- Size 195KB
- Sample210412-gpf5bnrc46
- SHA256 61097d05c78d0654fa42c1a404e96526b06c657df602a8a7a2ac58e1a60b52db
Score
10/10
Malware Config
Signatures
- Arcane log file 1 IoCs
Detects a log file produced by the Arcane Stealer.
- ArcaneStealer
Arcane Stealer is a .Net information-stealing malware that is easy to acquire in the dark web.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.28981.28903.1201.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.28981.28903.1201.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-114-0x000001D959F00000-0x000001D959F01000-memory.dmp
memory/648-117-0x000001D95A120000-0x000001D95A121000-memory.dmp
memory/648-116-0x000001D9747F0000-0x000001D9747F2000-memory.dmp
memory/648-118-0x000001D95A3A0000-0x000001D95A3A1000-memory.dmp
memory/648-119-0x000001D95A3D0000-0x000001D95A3D1000-memory.dmp