Overview

overview

5

Static

static

1

SecuriteIn...30.exe

windows7-x64

4

SecuriteIn...30.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 23:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe

  • Size

    8.8MB

  • MD5

    2335a750096cb245737b423794866a82

  • SHA1

    29c676cf08535b01889a94bd181bc22f5d70459e

  • SHA256

    7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d

  • SHA512

    6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9

  • SSDEEP

    196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\is-PBOLB.tmp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PBOLB.tmp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.tmp" /SL5="$A0090,8637066,199680,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2660
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:840
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3000

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\is-D4S7S.tmp\isxdl.dll
      Filesize

      152KB

      MD5

      82201cd8f401f00000b7575b24b3ad0b

      SHA1

      fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

      SHA256

      9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

      SHA512

      a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\is-PBOLB.tmp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.tmp
      Filesize

      1.2MB

      MD5

      cd31650b1825f94d40916975931def27

      SHA1

      797184e1856305b590ea138f6fa4139499c1f60b

      SHA256

      04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

      SHA512

      13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Systweak\adu\ipini.ini
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Systweak\adu\sfuni.ini
      Filesize

      950B

      MD5

      caf32298001381bb9696645f4db64caa

      SHA1

      d0e50b705ba2c619dd2f202aa7f8f47e74cf2650

      SHA256

      81a16e7543fca64fb42230575baeca38a0d6f28b5a957c24b37961a90782d13d

      SHA512

      3ff840f490f9ad637e427685420ed29591eba2c87cb01a7d4030f684bd93f999d9981c34289f95709138f3d75bb92e30e6560593c849e34acc684b1ac3820589

      Download Submit
    • memory/2752-0-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/2752-2-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/2752-37-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/2828-7-0x0000000002440000-0x0000000002441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2828-38-0x0000000000400000-0x000000000053E000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/2828-41-0x0000000002440000-0x0000000002441000-memory.dmp
      Filesize

      4KB

      Download