Analysis
- max time kernel
129s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
11/02/2024, 18:24
General
- Target SecuriteInfo.com.Trojan.TR.Dropper.Gen2.28812.6709.exe
- Size 4.8MB
- Sample240211-w12ccacd68
- SHA256 58f720c7664a0eea1e99b9293dffba1d45930a1ace26ba296ae81f461d5953d1
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen2.28812.6709.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen2.28812.6709.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJJ4tLTSky.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\Recovery\WindowsRE\WmiPrvSE.exe"C:\Recovery\WindowsRE\WmiPrvSE.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
lsass.exe
VJJ4tLTSky.bat
memory/4564-0-0x0000000000C20000-0x00000000010EE000-memory.dmp
memory/4564-1-0x00007FF97DBA0000-0x00007FF97E661000-memory.dmp
memory/4564-2-0x000000001BE40000-0x000000001C0AE000-memory.dmp
memory/4564-3-0x000000001C210000-0x000000001C220000-memory.dmp
memory/4564-5-0x00000000018D0000-0x00000000018F6000-memory.dmp
memory/4564-6-0x00007FF99A280000-0x00007FF99A33E000-memory.dmp
memory/4564-7-0x00007FF99A270000-0x00007FF99A271000-memory.dmp
memory/4564-9-0x00000000018B0000-0x00000000018BE000-memory.dmp
memory/4564-10-0x00007FF99A260000-0x00007FF99A261000-memory.dmp
memory/4564-12-0x0000000001A40000-0x0000000001A5C000-memory.dmp
memory/4564-13-0x00007FF99A250000-0x00007FF99A251000-memory.dmp
memory/4564-14-0x0000000003370000-0x00000000033C0000-memory.dmp
memory/4564-17-0x00007FF99A240000-0x00007FF99A241000-memory.dmp
memory/4564-16-0x00000000018C0000-0x00000000018D0000-memory.dmp
memory/4564-18-0x00007FF99A230000-0x00007FF99A231000-memory.dmp
memory/4564-20-0x0000000001A60000-0x0000000001A78000-memory.dmp
memory/4564-22-0x0000000001900000-0x0000000001910000-memory.dmp
memory/4564-23-0x00007FF99A220000-0x00007FF99A221000-memory.dmp
memory/4564-24-0x00007FF99A0E0000-0x00007FF99A0E1000-memory.dmp
memory/4564-26-0x0000000001910000-0x0000000001920000-memory.dmp
memory/4564-28-0x0000000001920000-0x000000000192E000-memory.dmp
memory/4564-29-0x00007FF99A0D0000-0x00007FF99A0D1000-memory.dmp
memory/4564-31-0x00000000033E0000-0x00000000033F2000-memory.dmp
memory/4564-33-0x00000000033C0000-0x00000000033D0000-memory.dmp
memory/4564-34-0x00007FF97DBA0000-0x00007FF97E661000-memory.dmp
memory/4564-35-0x00007FF99A0C0000-0x00007FF99A0C1000-memory.dmp
memory/4564-36-0x00007FF99A0B0000-0x00007FF99A0B1000-memory.dmp
memory/4564-38-0x0000000003420000-0x0000000003436000-memory.dmp
memory/4564-40-0x00007FF99A0A0000-0x00007FF99A0A1000-memory.dmp
memory/4564-39-0x000000001C210000-0x000000001C220000-memory.dmp
memory/4564-42-0x0000000003440000-0x0000000003452000-memory.dmp
memory/4564-43-0x00007FF99A090000-0x00007FF99A091000-memory.dmp
memory/4564-44-0x000000001C750000-0x000000001CC78000-memory.dmp
memory/4564-45-0x00007FF99A080000-0x00007FF99A081000-memory.dmp
memory/4564-47-0x00000000033D0000-0x00000000033DE000-memory.dmp
memory/4564-48-0x00007FF99A070000-0x00007FF99A071000-memory.dmp
memory/4564-50-0x0000000003400000-0x0000000003410000-memory.dmp
memory/4564-52-0x0000000003410000-0x0000000003420000-memory.dmp
memory/4564-53-0x00007FF99A060000-0x00007FF99A061000-memory.dmp
memory/4564-56-0x000000001C220000-0x000000001C27A000-memory.dmp
memory/4564-55-0x00007FF99A050000-0x00007FF99A051000-memory.dmp
memory/4564-58-0x000000001C1B0000-0x000000001C1BE000-memory.dmp
memory/4564-59-0x000000001C210000-0x000000001C220000-memory.dmp
memory/4564-60-0x00007FF99A040000-0x00007FF99A041000-memory.dmp
memory/4564-63-0x000000001C1C0000-0x000000001C1D0000-memory.dmp
memory/4564-61-0x00007FF99A030000-0x00007FF99A031000-memory.dmp
memory/4564-66-0x000000001C1D0000-0x000000001C1DE000-memory.dmp
memory/4564-64-0x00007FF99A020000-0x00007FF99A021000-memory.dmp
memory/4564-68-0x000000001C280000-0x000000001C298000-memory.dmp
memory/4564-69-0x00007FF99A010000-0x00007FF99A011000-memory.dmp
memory/4564-71-0x000000001C2F0000-0x000000001C33E000-memory.dmp
memory/4564-72-0x00007FF99A000000-0x00007FF99A001000-memory.dmp
memory/4564-88-0x00007FF99A280000-0x00007FF99A33E000-memory.dmp
memory/4564-89-0x00007FF97DBA0000-0x00007FF97E661000-memory.dmp
memory/4932-94-0x00007FF97DBA0000-0x00007FF97E661000-memory.dmp
memory/4932-95-0x00007FF99A280000-0x00007FF99A33E000-memory.dmp
memory/4932-97-0x00007FF99A270000-0x00007FF99A271000-memory.dmp
memory/4932-99-0x00007FF99A260000-0x00007FF99A261000-memory.dmp
memory/4932-101-0x00007FF99A250000-0x00007FF99A251000-memory.dmp
memory/4932-103-0x00007FF99A240000-0x00007FF99A241000-memory.dmp
memory/4932-106-0x00007FF99A230000-0x00007FF99A231000-memory.dmp
memory/4932-107-0x00007FF99A220000-0x00007FF99A221000-memory.dmp
memory/4932-109-0x00007FF99A0E0000-0x00007FF99A0E1000-memory.dmp
memory/4932-110-0x0000000002C70000-0x0000000002C80000-memory.dmp