Overview

overview

10

Static

static

SecuriteIn...03.exe

windows7-x64

10

SecuriteIn...03.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 02:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103.exe

  • Size

    317KB

  • MD5

    b76efe08c80977c7f06c25a6cbcee520

  • SHA1

    9e70c64be6657f8b079e5929ba0b568664c4680c

  • SHA256

    a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e

  • SHA512

    97e09179aa2f5f20c6d5a75e470c7460805cea827ce83cd09d5c440fdfbc56981828c581ccd148a2307c14f8645135edf7f3fb6376b30bf077b63d23f4bb0620

  • SSDEEP

    6144:yHvYLLzG+kfkCgMxRtyzRCZzquZb26b2EAkrrLWV35Dr8IB:yHvYL3G+kcXM8RCBqgb26DXLWRx

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1476
      2⤵
      • Program crash
      PID:936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4696 -ip 4696
    1⤵
      PID:540

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4696-132-0x00000000008CE000-0x00000000008FF000-memory.dmp
      Filesize

      196KB

      Download
    • memory/4696-133-0x0000000000810000-0x000000000084E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/4696-134-0x0000000000400000-0x000000000066C000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4696-135-0x0000000004EE0000-0x0000000005484000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4696-136-0x0000000002720000-0x00000000027B2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4696-137-0x00000000056A0000-0x0000000005CB8000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/4696-138-0x00000000054C0000-0x00000000055CA000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4696-139-0x00000000055F0000-0x0000000005602000-memory.dmp
      Filesize

      72KB

      Download
    • memory/4696-140-0x0000000005610000-0x000000000564C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/4696-141-0x00000000008CE000-0x00000000008FF000-memory.dmp
      Filesize

      196KB

      Download
    • memory/4696-142-0x0000000005F30000-0x0000000005F96000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4696-143-0x0000000006620000-0x00000000067E2000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/4696-144-0x0000000006800000-0x0000000006D2C000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4696-145-0x00000000008CE000-0x00000000008FF000-memory.dmp
      Filesize

      196KB

      Download
    • memory/4696-146-0x0000000000400000-0x000000000066C000-memory.dmp
      Filesize

      2.4MB

      Download