Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
28/03/2025, 03:44
General
-
Target
SecuriteInfo.com.Program.Unwanted.5599.24375.1194.exe
-
Size
21.5MB
-
MD5
148d636231401a42505e096ae2a3d31e
-
SHA1
53261dfeeb8ba52b86cf82180fed669e52984519
-
SHA256
db3e5db9746c7222963c28c9411c8c7d2faac25f1f05ee5651145334b807a605
-
SHA512
1a8ed377117d3fe7fad8babfeffd11968d5cba76d50e0a436462348f6aca0ed7dfbdd8eb3d289923630a4a28c1ed79fd241d2cb0a88b5d4d1dbb571f9545f32f
-
SSDEEP
393216:watZoxR0iWhfetojPSyJPGXscPZf0+IMzeioZNfSMe9zQkPR5h8AmDNqFBtItS7K:w2KYhfnxGfBc+zeioZN/ozQk98AmDy5S
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.24375.1194.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.24375.1194.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EMJG2.tmp\SecuriteInfo.com.Program.Unwanted.5599.24375.1194.tmp"C:\Users\Admin\AppData\Local\Temp\is-EMJG2.tmp\SecuriteInfo.com.Program.Unwanted.5599.24375.1194.tmp" /SL5="$4010A,22077823,146944,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.24375.1194.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD5e50f65e9f67c0c2c63bd9175d2ed824e
SHA161e1a79b023ab2f7307947955395d355da5d7791
SHA256d3055229d7f292a23f5195c0a473c219433bda9d3a5e99a43062ea6a84d7a3a0
SHA5121afa52e2243c196de01f396d7c81414af0bb6bca3c9d3258f144c634cf00cb170c423216b9a2163826d2481271c60b65f0987f2606998f41ea1df4f5f6dbec24
-
Filesize
2.5MB
MD597fd3089745d2a3bb2d20add1b4cfc78
SHA13bff7a3e7b031d3a62226222b99bf04d6b49ab25
SHA256cec1a7fc0d3cb5ecfea61be05cbc50b3323b8cb6f9e9f97f813b79c88d99182d
SHA512d73c3e55aa65a2fae1ccacf916cbad57bd23c1a5b4861d307b956ebccb02a81949e8e7eef29324bb30ca997c094651942bafa3badc2dc50e7f5bf41802ef2e27
-
Filesize
8.8MB
MD5a0b6b743dfa0bf54175cb468e984336e
SHA1dea0e524624983f9badd1eb6d1d3ced3afd5051a
SHA2568c165b3edd1ced3276731b3f440947ccb52f7b20043933a74024718ac4a57392
SHA5123a17a13d2efe366647770d3b611069baabda160f62bf2fe088b6de8516206f3cc890699abbc0ae853dd2ecc5bcd1f41ee50e42dd83331d06cd0048a0a50ea42f
-
Filesize
2.0MB
MD573e346feffd403c5563bb90921b4f1c8
SHA11dd914d86be5f254e8a981c7ec7386e77cf79576
SHA256a598fc217ed0f1d2a3f363490961f030adbbed352527d9afff84bcd8d6262172
SHA5129b5d5440a998d4797b95c6cf61b7097a75a7ec321890f5624d5ed2be9d4be212b0f02f2b377441d449223a685b096c4ec5426624d58a8f47af699a7bd2c5d7ae
-
Filesize
97KB
MD5a2290094a52eae96c81eb762bc9e6331
SHA1ab84db3dd2bf3cc1424e6011686f75a99a3a9a40
SHA2566c47561d57de8b673160d8c2dde6667753aa3e4ac24a44950b7845fddc65369f
SHA5126cbbfd73edc8e53c5da0f6b589b61378ae69e99b5e918a1cc405afb8d0e52f792e5cbc4feb78b3579fc87dde60755aa3a39798842188c7bc9f3ee7317baf3b8e
-
Filesize
345KB
MD594dca7eca6944692a687565392f4bf16
SHA1f1550a9c7c1d091792713b59a257d506ab3777b1
SHA256635be68cf6ddb8de72208e3b9d5a80c41dd0585c42a727c9958cfef109a76816
SHA5121b00581597b96439568820c4feb7969d0840f4b2454ce6bd3cbdcd2562207d1bf7aef6b58d155a68371735acf696f63871d43212140da129cc3d9fc9a5a54d1f
-
Filesize
9.0MB
MD5c479e499c43d824246569c7afc12a987
SHA184fc35239b55d85594e3c65ef21519817d3b2cea
SHA25678ca32bf9357309254dfaef094f287f45e0cd70a4bea027ec95e3fca4d4b3cc2
SHA512a4ff168e1add86395f2d4e3335337ec7e432398ad2baa44e3ab1a97830c1b32d541d17d965b00cd0cdb5d6331b262bf280a76da322647e2e89367b6c4b1813a5
-
Filesize
177KB
MD5cd05fe6088850b36d2540805f02d8ebd
SHA10be8fd6d6837f444b363ded140b8f3de594cd03e
SHA25604b649902a180c1531282de2038bfbc01a8b297a56282a785848525ac10ebac2
SHA5122b2d315a890df23f857f9d50884d1a8f5824c3611a2137a859a6f7ed62076882c3b86e5e222e63a0bb4b2f54758b824ec4c33e825c31be6e9d60d0af7e9d53d6
-
Filesize
192KB
MD561b0aace0a37b00f33e0f1cf5f9f38ec
SHA124921bc36461dae98a961dae57d25fa17e710e83
SHA256ac7e5695941851571ab4ec88dd0773346461622238366d741ccd9f165e0655b9
SHA512ebd0ce4f5d44e452fd167498b65bdf2a5754b637bb8370bf6d5e5ee9926d8dc1a7671c82650ff832936b6acfe7e8a22df5b776b3d1aa29e00149391563cec5e4
-
Filesize
1.6MB
MD53fe36d25b8a2287bd61a571de8178572
SHA1a7e2b658cfbd4c1e7df7fd89eb2f989c73eceaea
SHA256c00e9807332d316fb5ed1584407fe6f6b8748aab39efd9fea6a3aacb5caf39c9
SHA5126905685fc321539d7a52007a4cd7e332288deaf253f752c9949fbce68743238951c37294d32d70a187727070b5b05858791612d334a28aa9acf36610f2bd30b0
-
Filesize
10.1MB
MD5942cc74b7ef66b51859d135fa3bc8bb2
SHA1642810b822d9e4ddd40faafb7437b552d2ad7d56
SHA25666f2f6b2e8c24827d63f6415094ae40fddd50f30e097cda395cc0116d57356a6
SHA512941e41ed4031674168d4b4380d52cdea4d3077c1e871a9f61d8c85030befda654b06cb5da666d906130fa2d5b985573b274f9d77ac570b634be295baefa385e5
-
Filesize
3.9MB
MD5e4f482e3f7eb949256402c38e467122f
SHA12910db3ffc1769d2ae83b6569fa91e79faaa4033
SHA25610b9d8569b8f9e9e46e7a579855492353c43f1e3b5d4a28959015bed5570350c
SHA5128dc4eadc0ebe0cc86e7ac85843c16be5cc563a5dce2985f34b4769786e5d2f7176b62506854ef5e5b75a58aa1cbe45934650e7cab098a639bc62affe9119241b
-
Filesize
355KB
MD557496780b9a5c733144e5663f088f42a
SHA1ccdd74d1a638629f8fdba43ce1180a23d7a463dc
SHA2566be794294ff9c4b27debc6ed50fce865d028cf496d4e39fcce9c4f8e48cbfbfd
SHA51250cf52cc8524551e9fd106c823039f604df2b92d2de859ef2d4b85016d603a6c31dc928e155949554c20ebd63f5b5665b627cc8853576a6149f2213b533f16d0
-
Filesize
1.2MB
MD50c8aad3db1436371794e0440b585ee9e
SHA1c67b07c3498eafb561be7c8a06ce912899f6cb14
SHA2569b61476504c3ed1ee746df2d4d4a1e98152ce57b95b1bc9da90f073918c6674a
SHA5124872f63f3e6a1fe10aca0fda34f2beb7ca8b8649283a2f59258576b9951123a96da2bdbb4d3aefde1e00477e484429f8f585501facad35799021a87ad2fc48cd
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
68KB
-
Filesize
128KB
-
Filesize
1.6MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
356KB
-
Filesize
2.5MB
-
Filesize
184KB
-
Filesize
8.8MB
-
Filesize
108KB
-
Filesize
360KB
-
Filesize
1.6MB
-
Filesize
2.0MB
-
Filesize
200KB
-
Filesize
360KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
184KB
-
Filesize
108KB
-
Filesize
356KB
-
Filesize
200KB
-
Filesize
2.5MB
-
Filesize
3.9MB
-
Filesize
10.1MB
-
Filesize
1.2MB
-
Filesize
8.8MB