IOC Report
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_157921775d97238581ed3b366b95cf1c64be916_659c366a_92538246-93df-4565-a726-1d27617655d3\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_beab1a24e9683be28b983258c9265328e81ee45_659c366a_7f945e3d-5e31-4c48-903a-f07ec79a8b51\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER398.tmp.dmp

Mini DuMP crash report, 14 streams, Thu Apr 25 03:34:11 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D7.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F8.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C1D.tmp.dmp

Mini DuMP crash report, 14 streams, Thu Apr 25 03:33:29 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C5C.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C8C.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe

"C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4440
Target ID:	0
Parent PID:	1028
Name:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe"
Size:	4091904
MD5:	A920AC600A4EECE342DF14133EB71D2D
Time:	05:33:28
Date:	25/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	4091904
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file does not import any functions	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 232

Details

Is windows:	true
Is dropped:	false
PID:	6644
Target ID:	3
Parent PID:	4440
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 232
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	05:33:28
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x6b0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 232

Details

Is windows:	true
Is dropped:	false
PID:	6572
Target ID:	9
Parent PID:	4440
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 232
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	05:34:11
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x6b0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://www.clamav.net

unknown

Details

Name:	http://www.clamav.net
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe
Source:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27276.2863.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://upx.sf.net

unknown

Registry

Path

Value

Malicious

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

ProgramId

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

FileId

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

LowerCaseLongPath

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

LongPathHash

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Name

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

OriginalFileName

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Publisher

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Version

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

BinFileVersion

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

BinaryType

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

ProductName

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

ProductVersion

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

LinkDate

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

BinProductVersion

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

AppxPackageFullName

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

AppxPackageRelativeId

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Size

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Language

\REGISTRY\A\{8b2974a3-cc37-f533-d4e3-a8fb8444a111}\Root\InventoryApplicationFile\securiteinfo.com|e6fb44860a454f9e

Usn

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property

0018000FFE49BC6C

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}

DeviceTicket

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}

DeviceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}

ApplicationFlags

There are 13 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

401000

unkown

page execute read

4A6000

unkown

page write copy

4A2000

unkown

page readonly

A8A000

heap

page read and write

A80000

heap

page read and write

4D6000

unkown

page write copy

8D0000

heap

page read and write

1F0000

heap

page read and write

400000

unkown

page readonly

A8E000

heap

page read and write

19D000

stack

page read and write

4D9000

unkown

page write copy

7E4000

unkown

page readonly

401000

unkown

page execute read

9D000

stack

page read and write

400000

unkown

page readonly

4D6000

unkown

page write copy

4A2000

unkown

page readonly

7E4000

unkown

page readonly

8C0000

heap

page read and write

4D9000

unkown

page write copy

4A6000

unkown

page write copy

There are 12 hidden memdumps, click here to show them.