Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe
- Size 618KB
- Sample260924-2e37psysat
- SHA256 b641e7d6d757a5b898c97a3b0482cf2257646e67a6aeaf5ffcebce1a7d5f1565
- MD5 8854ad59fc4de27ae5be72a56a70cf4d
- SHA1 63682124a6d5afa38789bb8fd6f2a71e35be7ccb
- SHA512 1b8a19439a1b736a23a0e1937c7b0b6e9b1903422f0975590697255035dbad9ff8b013e480f87f4ed5ed5d4219c12a9a2ddd470069a7933aad8b7d9353f5237c
- SSDEEP 12288:rxlJUIGcwLSeeBKF0RjGaMJnl/bDU0/BsGRoXNDzWj8:r9UE0d1nVbBvoXN3
- TLSH T18ED4E0A1B6E420E5F926C073C18757549DEAFC621F505BFBA2240A192F711D8CF3AF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\pimpernel\eellyuept.txt SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe File opened for modification C:\Program Files\prepositions\fooncyetz.dat SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5692 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3440 SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3440 wrote to memory of 5692 3440 SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader50.24032.15730.27481.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3440
-