Overview

overview

10

Static

static

SecuriteIn...98.exe

windows7_x64

10

SecuriteIn...98.exe

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    16-04-2021 10:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe

  • Size

    283KB

  • MD5

    1f130569a8373dfae4f387d4757769cf

  • SHA1

    038f27c37ade7fcb97745e149b65258a7a1ea295

  • SHA256

    ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97

  • SHA512

    7401da486a4141efe362f3ba80299f3305e05866e7a04cad8a40107fe6a83765e4616af4ef6f6f40b605135cd34a3c48dedc6023ee32facfb8b4984f29cfa7b3

Score
10/10
dcratdiamondfoxbotnetdiscoveryinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 3 IoCs

    Detects DiamondFox payload in file/memory.

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        "wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1128
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        "wmic" os get caption /FORMAT:List
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:548
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        "wmic" path win32_VideoController get caption /FORMAT:List
        3⤵
          PID:1124
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          "wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List
          3⤵
            PID:1644
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            "wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List
            3⤵
              PID:1084
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              "wmic" path win32_PingStatus where address='vladisfoxlink.ru' get StatusCode /FORMAT:List
              3⤵
                PID:1072
              • C:\Windows\SysWOW64\Wbem\wmic.exe
                "wmic" path win32_PingStatus where address='vladisfoxlink.ru' get ResponseTime /FORMAT:List
                3⤵
                  PID:1516
                • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
                  /scomma "C:\Users\Admin\AppData\Local\Temp\1.log"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1776

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1572-68-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

              Download

            • memory/1572-67-0x0000000075551000-0x0000000075553000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1572-65-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

              Download

            • memory/1632-60-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1632-64-0x00000000004B0000-0x00000000004B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1632-63-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1632-76-0x0000000000BF5000-0x0000000000C06000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1632-62-0x0000000000470000-0x00000000004AF000-memory.dmp

              Filesize

              252KB

              Download

            • memory/1776-77-0x0000000000400000-0x000000000047C000-memory.dmp

              Filesize

              496KB

              Download

            • memory/1776-80-0x0000000000400000-0x000000000047C000-memory.dmp

              Filesize

              496KB

              Download