Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
23/09/2023, 22:32
General
- Target SecuriteInfo.com.Win32.TrojanX-gen.16867.135.exe
- Size 473KB
- Sample230923-2fx23sag21
- SHA256 a7dbe6bbc3e54f311a6aff5abe94c1659cbbb4b18b6388530d3a5090ad92b49c
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.16867.135.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.16867.135.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3448-1-0x0000000002710000-0x0000000002810000-memory.dmp
memory/3448-2-0x00000000041F0000-0x0000000004240000-memory.dmp
memory/3448-3-0x0000000000400000-0x00000000025CA000-memory.dmp
memory/3448-4-0x00000000045B0000-0x0000000004616000-memory.dmp
memory/3448-5-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/3448-6-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-8-0x0000000006F70000-0x0000000007514000-memory.dmp
memory/3448-9-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-7-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-10-0x0000000004690000-0x00000000046F2000-memory.dmp
memory/3448-11-0x0000000004950000-0x00000000049E2000-memory.dmp
memory/3448-12-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-13-0x0000000009AE0000-0x0000000009AEA000-memory.dmp
memory/3448-14-0x0000000009B10000-0x000000000A128000-memory.dmp
memory/3448-15-0x000000000A1C0000-0x000000000A1D2000-memory.dmp
memory/3448-16-0x000000000A1E0000-0x000000000A2EA000-memory.dmp
memory/3448-17-0x000000000A2F0000-0x000000000A32C000-memory.dmp
memory/3448-18-0x000000000A370000-0x000000000A3BC000-memory.dmp
memory/3448-19-0x0000000002710000-0x0000000002810000-memory.dmp
memory/3448-20-0x000000000A510000-0x000000000A576000-memory.dmp
memory/3448-21-0x000000000AD00000-0x000000000AD76000-memory.dmp
memory/3448-22-0x000000000ADD0000-0x000000000AF92000-memory.dmp
memory/3448-23-0x000000000AFB0000-0x000000000B4DC000-memory.dmp
memory/3448-24-0x00000000041F0000-0x0000000004240000-memory.dmp
memory/3448-25-0x000000000B5E0000-0x000000000B5FE000-memory.dmp
memory/3448-26-0x0000000000400000-0x00000000025CA000-memory.dmp
memory/3448-28-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/3448-29-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-30-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-31-0x0000000004620000-0x0000000004630000-memory.dmp
memory/3448-32-0x0000000004620000-0x0000000004630000-memory.dmp