Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
08/06/2026, 16:25
General
- Target SecuriteInfo.com.Trojan.Mardom.MN.11.44588326.exe
- Size 554KB
- Sample260608-txde1ab14w
- SHA256 386793476ba094dac1371ef925bffbbe0990175a3a1abdc17637cf52a6288c20
Score
7/10
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.11.44588326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.11.44588326.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk"2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff848dfc728,0x7ff848dfc734,0x7ff848dfc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,4175193817438336382,15871590458121990953,262144 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,18421431738932456666,7201649837416387358,524288 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:113⤵
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,2602053849405958697,6351612334831020412,524288 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,8594848808901243709,1573796891244526731,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,8488333493534246315,17949588366602955071,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3088,i,16134095461542789780,9169939435069050202,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3112,i,11465790094811755532,5186972083585091252,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4076,i,13730746147265193269,14961352345365388206,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4140,i,11605166864744027165,17363414553180492958,2097152 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sc1zhuix.3bk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4104,i,13682680731869798889,14257543384617577128,524288 --field-trial-handle=1912,i,6824539205588988373,113445759395706014,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
data_0
data_1
data_2
data_3
f_000001
f_000002
index
ba678a2fbd8c358c_0
the-real-index
the-real-index
index
index
CURRENT
MANIFEST-000001
index
SCT Auditing Pending Reports
README
2cc80dabc69f58b6_0
4cb013792b196a35_0
4cb013792b196a35_1
the-real-index
index
the-real-index
data_0
data_1
data_2
data_3
index
memory/3688-150-0x0000000000B80000-0x0000000000C80000-memory.dmp
memory/3688-9-0x00000000072D0000-0x0000000007362000-memory.dmp
memory/3688-1-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3688-151-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3688-149-0x00000000064E0000-0x00000000065E0000-memory.dmp
memory/3688-211-0x00000000074E0000-0x00000000074F2000-memory.dmp
memory/3688-0-0x00000000005B0000-0x0000000000640000-memory.dmp
memory/3688-11-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3688-10-0x0000000007560000-0x00000000075B0000-memory.dmp
memory/3688-155-0x00000000064E0000-0x00000000065E0000-memory.dmp
memory/3688-8-0x0000000007950000-0x0000000007EF6000-memory.dmp
memory/3688-7-0x00000000070C0000-0x0000000007126000-memory.dmp
memory/3688-6-0x0000000006E90000-0x0000000006EC6000-memory.dmp
memory/3688-5-0x0000000006C80000-0x0000000006D54000-memory.dmp
memory/3688-4-0x0000000005470000-0x00000000054BC000-memory.dmp
memory/3688-3-0x0000000005360000-0x0000000005438000-memory.dmp
memory/3688-2-0x00000000052E0000-0x000000000535A000-memory.dmp
memory/3732-152-0x0000022BCB4D0000-0x0000022BCB5A4000-memory.dmp