Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-02-2024 21:23
General
-
Target
SecuriteInfo.com.Trojan.PWS.Stealer.38408.30550.27254.exe
-
Size
13.1MB
-
MD5
ffad668e3893f27d0011b0acbc580477
-
SHA1
23ec45c30d56f48fd70ce794c4ffe8df53d0fc93
-
SHA256
6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122
-
SHA512
1930ca8726f0fa9435f84f484dc99d3925308d065a498270fa427241134bbf99d0bba3e58baea71a982a3c585014f4957acaa97a0aea343157cb14ca3a3080ab
-
SSDEEP
393216:SO+TZ1nFOl+bzkCu1tsTmtCyJnQYSvWXr/:SlZ1nS8Du126tCmb
Malware Config
Signatures
-
An infostealer written in Python and packaged with PyInstaller. 2 IoCs
-
crealstealer
An infostealer written in Python and packaged with PyInstaller.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.38408.30550.27254.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.38408.30550.27254.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_2364_133532833899086000\test.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.38408.30550.27254.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD52135da9f78a8ef80850fa582df2c7239
SHA1aac6ad3054de6566851cae75215bdeda607821c4
SHA256324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
SHA512423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369
-
Filesize
7.7MB
MD578d3cd14c1fcbd2f6cc7514b76f5e0ec
SHA1eb41f5cc457ce2c3357a2036c09430070f59bb4f
SHA256c1b5f7e54f4226981c0f8af5e13f7c8c0faade9aaee7fbcc6b75bd6cb01c8efd
SHA512e974dfe29006684d0e4f842ed0f23df2391626dbe7dba0129230ad7368a95f3ffb475daeea050dc35216ef0e7208c37f9652cb76fe5873e157e785e699bc36c2
-
Filesize
7.5MB
MD57255ea73a7cc8280091301dd9e6c0806
SHA1b9d9dc1e59059f50c263ef40c399c0183042c3d1
SHA2561cd318d987a414424f6d480a892553cb4eedfca39cc97c9703953ee3e4347cd0
SHA5121f4e7bc42b37f1537184af898af033b28f1fe4560b4fe44d25fc7a330d266dd86c3873bfd0ccac1cd8c6c51c149f15aedf032e8a32b7c5db121adaf1ff9415ff
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
24.5MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
24.5MB
-
Filesize
24.5MB
-
Filesize
1.7MB