Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/03/2025, 03:44
General
-
Target
SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe
-
Size
20.0MB
-
MD5
e5293b3cb9e4f710b5c1bec09ea16d85
-
SHA1
4063cb95a16891b3b6c99354b5473fce31721496
-
SHA256
6fd31ad446a222eb27dd578b3b66cd9e6f667d47a256441c70d7410563cab489
-
SHA512
5f750c7676a41aaf445736ac7661d75e9cce6e2993a2f5ef9567ffe30c39d528b759895c83db6d45f647a50e22ecb4200adb1a8384fa8760e97f9b3cc129d051
-
SSDEEP
393216:jtVjUU7FxD+31pK5cV7MQ4graklxuxpWEn73cYkktZROwRAgUPG4THTjYc+rG+vW:5VjUU7FxD+loCV7f4gWkxu/3cHk7ryGQ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JKSQD.tmp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.tmp"C:\Users\Admin\AppData\Local\Temp\is-JKSQD.tmp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.tmp" /SL5="$40150,20502182,505856,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc
-
Filesize
357KB
MD581aa5634a4f4e55207f0a46360236127
SHA153d3f8c4ede5c95851db9a5951392997123b7188
SHA256ced60f075f2c3e311833cf6280e1eda0a46ab8a9916e4f5f8cc015481a77e1d6
SHA512b206467bb27efa339e471866677f8c3f10d2553a2788df4fa444ae115bdf262f510aad8e5d1ccddd36f79ae9df9981e7c8b7d0e622009f82a7ac1be3f70b0839
-
Filesize
1.5MB
MD53af39fa30f4fcd4628e15a0a2ab3af12
SHA130a221318994600b615b7daae9316fbc7e8820c9
SHA256ce704900f617ec71cbef6eb8a4a517c2768937e6c3e862becf7a846bb516f401
SHA5123ed16998cc64307674b19c7332a75094244555a55b88e44a830f950a4e21d93fe44d3d11438ecef71608c5a67b8a1612b505ca8e9adf0322451aea0f9890210e
-
Filesize
2.5MB
MD507d0149eb09496eb54a372ae489f7565
SHA193debd1030161acbc1f999ed4a87176f12e0e0f4
SHA2563587192b3334258f3c41be810e5980b8aa51de3dbf04228dfee67b75681516ef
SHA512b1cc9a8380550988b4e336121f20e04b3f44b49f51075587f677e38199bf4dda95411d4258aaa2962472936fce3ac94e6c8bad5d4533b1f1e8493ffb2464d679
-
Filesize
8.8MB
MD58724e5f0b2e64b0d0d905ad8fb493d52
SHA186e90b22b180ecb3e70e0989a4eeb927e39ea1a1
SHA256dbeb9160511ffeab19082ada9273e20fe4c0b7e2721cb0ae640f26d634862299
SHA5120fcc63a0c9291c9a0b6acf89a7121ed2c0a94785ed7dce5b3eb4251c9bf0b2af0148d40ec07fc64ed837abd51f84db4a1c6a32436fec93b06a62f9e9807ef0c2
-
Filesize
2.1MB
MD57d799f726584d2e7ea2e9c2e366124bd
SHA1d9feb7c91bc46005b5caeca3873da848ea057a0d
SHA256981a6756b2c39a8d096c0e2a64d6962553c522253018597d25d9e3ac38836832
SHA512b705d302a691ad47a4cb9ba6c0c8336b7af3b93bb7d36c35a5a3c68b2537fe62420634785600b1b301717b803d961bb92f8525f5c91fce732db931cf935ecf74
-
Filesize
97KB
MD5948ed0ffac9dbd853cd2b02a33bc5709
SHA13fcfd2d09a5a89ab9a6040b4d4d438ebd2dcc48d
SHA256dc894ea2334c057843cb0e53ade93a52a82f960198fcfd66f88c7fa9a1c60c5c
SHA512a178dea22381d7f0ad9874e195c8675939102f032bf2f5f4bca8e6ea4b339b34b188a1a69b890bf18bded48de386069896442bfe56304d6db1b61497d9717294
-
Filesize
345KB
MD59f8e05d118b228c0414443da40d5cdd5
SHA185a1f6b62fa0671a749cf47efd3f427f0bddc730
SHA2566fee4fd1fd06427bf6016fcfd3a9b64e3e3cf3a3b9db005c1a9e47a7764c40b0
SHA5128f952c066fa76cdbe9bf077b7a461fd019f9134fee779b23de97c570cffdd7a7ce7d7b0c0f919ae5c58afb410fd10a2e9990f83c07b8dfac5c7d6f0255355947
-
Filesize
141KB
MD56ed3eaa975a7831ad3438633a7ae89be
SHA176954e4a66502d2678a85fcabbf6cbe08d0de595
SHA25692abb2e877cfff30a1b7803d2e916da584cc525e77937619a2fb703e3c6d2288
SHA512c89011dff3a3b176246b48513c31a03d36a14249b427be4e8206fc78a9611f24ec585aae0199adeb2ba9e7b5ab290aeda8953a4b358021b907260f2c05099d0f
-
Filesize
5.0MB
MD538b9366adf103dd2a1934ca78978c358
SHA13aaf3cbc74cf52acd913f61614bed827d704f0c6
SHA25652f45d37307cc850f202dc2c20e5183ae9778e11feff6642f12fa64dad2abb09
SHA5122f93a595d64bd05d7997ed5d0de0f624d06d4f16f76f3473061d5fb20c45a8dfbe7cceda6f2a07e7338bc1ca7381089679d08e7f40122e2b51d1b55f4e1e3648
-
Filesize
192KB
MD53b3fdb2c16a2042f8deb5d4f8ff5644f
SHA189bba06f1141079071656c91d2bcfa74a7991173
SHA256195247a3bb0ec44211831838c166776568fc69a5b0bc7a431c8db885045e1a41
SHA512fa9f8ceddf656ad9f889bfda3c485f125b4965a1376e6145671fa9b6d147dd56cdffc41191f22b8abe5b287729d46c3bf2de41d4803179881fc0583d0dd12960
-
Filesize
2.1MB
MD521e7f07bab223d25d4d13b7ebd910c5c
SHA15452000d0f38a1d0912e2862ed597d27b5a61765
SHA256ddffdd6c8fa8475162f9e0159452edb59d9f0c133e594d011c792282fc079201
SHA5125585104f97c422a5726ce35fb08ab4677822672492662692cbeafceaba4f9a69753ef3c74c5c477d656daad2defd550b9b0ec0dd7b35fcf42d5ad025c6339c8a
-
Filesize
10.1MB
MD5942cc74b7ef66b51859d135fa3bc8bb2
SHA1642810b822d9e4ddd40faafb7437b552d2ad7d56
SHA25666f2f6b2e8c24827d63f6415094ae40fddd50f30e097cda395cc0116d57356a6
SHA512941e41ed4031674168d4b4380d52cdea4d3077c1e871a9f61d8c85030befda654b06cb5da666d906130fa2d5b985573b274f9d77ac570b634be295baefa385e5
-
Filesize
3.9MB
MD5e4f482e3f7eb949256402c38e467122f
SHA12910db3ffc1769d2ae83b6569fa91e79faaa4033
SHA25610b9d8569b8f9e9e46e7a579855492353c43f1e3b5d4a28959015bed5570350c
SHA5128dc4eadc0ebe0cc86e7ac85843c16be5cc563a5dce2985f34b4769786e5d2f7176b62506854ef5e5b75a58aa1cbe45934650e7cab098a639bc62affe9119241b
-
Filesize
355KB
MD557496780b9a5c733144e5663f088f42a
SHA1ccdd74d1a638629f8fdba43ce1180a23d7a463dc
SHA2566be794294ff9c4b27debc6ed50fce865d028cf496d4e39fcce9c4f8e48cbfbfd
SHA51250cf52cc8524551e9fd106c823039f604df2b92d2de859ef2d4b85016d603a6c31dc928e155949554c20ebd63f5b5665b627cc8853576a6149f2213b533f16d0
-
Filesize
108KB
-
Filesize
1.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1.5MB
-
Filesize
2.5MB
-
Filesize
128KB
-
Filesize
356KB
-
Filesize
8.8MB
-
Filesize
148KB
-
Filesize
360KB
-
Filesize
2.2MB
-
Filesize
200KB
-
Filesize
3.9MB
-
Filesize
360KB
-
Filesize
108KB
-
Filesize
148KB
-
Filesize
356KB
-
Filesize
200KB
-
Filesize
2.5MB
-
Filesize
8.8MB
-
Filesize
10.1MB
-
Filesize
2.2MB
-
Filesize
532KB
-
Filesize
68KB
-
Filesize
532KB