3f08e9e569954f74cc7ca941a14c078fadaa4001b15e9f19fc4fa1809f3d7fc6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
Size 231KB
Sample260426-yb29fsfv2x
SHA256 3f08e9e569954f74cc7ca941a14c078fadaa4001b15e9f19fc4fa1809f3d7fc6
MD5 d7d54b026921126e26862072d5a95255
SHA1 0d2f2913747aa0a0e701c5bba7c99b0cc3719ca5
SHA512 31f43839905a1902488adb56cee93af44982bc45c71b7b2f98eaa81023a32723106a88743f34f22a79e41f18efd0edc776300b2044deae6c1024b72fdfed1bb8
SSDEEP 3072:ienvsxfIlOcs6Oi5llxp5RIR4QUnHXmUlELC9FkwxB5ckpxBm0rCrMgjjreH9:iSsxfIlgvK3VCAD9MMkw9
TLSH
T1AA34D615F7E724ACF1B3C2B89E93537298B9FC14A130F96E626151513E16B20AF3CB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Identifier	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2036	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
2036	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
2036	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
2036	SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x00007FF6E7790000-0x00007FF6E7811000-memory.dmp

Download