Overview

overview

10

Static

static

SecuriteIn...98.exe

windows7_x64

10

SecuriteIn...98.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16/04/2021, 10:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe

  • Size

    283KB

  • MD5

    1f130569a8373dfae4f387d4757769cf

  • SHA1

    038f27c37ade7fcb97745e149b65258a7a1ea295

  • SHA256

    ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97

  • SHA512

    7401da486a4141efe362f3ba80299f3305e05866e7a04cad8a40107fe6a83765e4616af4ef6f6f40b605135cd34a3c48dedc6023ee32facfb8b4984f29cfa7b3

Score
10/10
dcratdiamondfoxbotnetdiscoveryinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 3 IoCs

    Detects DiamondFox payload in file/memory.

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe"
      2⤵
        PID:4048
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          "wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          "wmic" os get caption /FORMAT:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2340
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          "wmic" path win32_VideoController get caption /FORMAT:List
          3⤵
            PID:3896
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            "wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List
            3⤵
              PID:3972
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              "wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List
              3⤵
                PID:3196
              • C:\Windows\SysWOW64\Wbem\wmic.exe
                "wmic" path win32_PingStatus where address='vladisfoxlink.ru' get StatusCode /FORMAT:List
                3⤵
                  PID:2464
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  "wmic" path win32_PingStatus where address='vladisfoxlink.ru' get ResponseTime /FORMAT:List
                  3⤵
                    PID:3776
                  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46105395.24334.17798.exe
                    /scomma "C:\Users\Admin\AppData\Local\Temp\1.log"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3724

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/780-125-0x0000000005F80000-0x0000000005F81000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/780-117-0x0000000005020000-0x0000000005021000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/780-118-0x0000000004FC0000-0x0000000004FFF000-memory.dmp

                      Filesize

                      252KB

                      Download

                    • memory/780-119-0x0000000005300000-0x0000000005301000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/780-120-0x0000000004F80000-0x0000000005012000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/780-121-0x00000000053A0000-0x00000000053A1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/780-122-0x00000000050D0000-0x00000000055CE000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/780-116-0x00000000055D0000-0x00000000055D1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/780-114-0x00000000007B0000-0x00000000007B1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3276-126-0x0000000000400000-0x0000000000435000-memory.dmp

                      Filesize

                      212KB

                      Download

                    • memory/3276-123-0x0000000000400000-0x0000000000435000-memory.dmp

                      Filesize

                      212KB

                      Download

                    • memory/3724-134-0x0000000000400000-0x000000000047C000-memory.dmp

                      Filesize

                      496KB

                      Download

                    • memory/3724-136-0x0000000000400000-0x000000000047C000-memory.dmp

                      Filesize

                      496KB

                      Download