Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-11-2020 00:58
Static task
static1
Behavioral task
behavioral1
Sample
bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe
Resource
win7v20201028
General
-
Target
bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe
-
Size
581KB
-
MD5
16bf61b209cfed043e348b8d28fabbaf
-
SHA1
6e8285f96f9056d9483b0e5770644a7d67e90364
-
SHA256
bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754
-
SHA512
80d19eb5931bfeac07cfe330d57bd2be5a123c3beae3524cfb732230fd6919bb94b72a99c49f6318493d985f66f9133e62135108a2fa59f7a118d77906f5c513
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org 16 ip-api.com -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3816 648 WerFault.exe bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exeWerFault.exepid process 648 bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe 648 bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exeWerFault.exedescription pid process Token: SeDebugPrivilege 648 bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe Token: SeDebugPrivilege 3816 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe"C:\Users\Admin\AppData\Local\Temp\bcd93c7eb4909c04cacc58386cf50aec172ffb8f5f7161bcde3a973007b2f754.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 648 -s 26922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-0-0x00007FF99FC70000-0x00007FF9A065C000-memory.dmpFilesize
9.9MB
-
memory/648-1-0x0000029C99AD0000-0x0000029C99AD1000-memory.dmpFilesize
4KB
-
memory/648-3-0x0000029CB4080000-0x0000029CB40F0000-memory.dmpFilesize
448KB
-
memory/3816-4-0x0000019CC8D30000-0x0000019CC8D31000-memory.dmpFilesize
4KB
-
memory/3816-5-0x0000019CC9BA0000-0x0000019CC9BA1000-memory.dmpFilesize
4KB
-
memory/3816-6-0x0000019CC9BA0000-0x0000019CC9BA1000-memory.dmpFilesize
4KB
-
memory/3816-7-0x0000019CC9BA0000-0x0000019CC9BA1000-memory.dmpFilesize
4KB