Analysis
- max time kernel
30s - max time network
137s - platform
windows10_x64 - resource
win10-en - submitted
03/09/2021, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
9770d8c263122462bd1443a3a1ba6f1e.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 9770d8c263122462bd1443a3a1ba6f1e.exe
- Size 198KB
- Sample210903-ak2saafaak
- SHA256 7173381414ec85250c6bd3c9b803f2d49b98a7826c8aeea37d9328d5e74d7fb6
- MD5 9770d8c263122462bd1443a3a1ba6f1e
- SHA1 8467cf8260ff78b94f57c925e592e377e45782bc
- SHA512 242e15832e4013cfb67c18487459a504836325dbf8835de1580b0f2d64f9d2f7c5fc5b9a4e1b2e1ec3777e34e8abfce9111c27942a49a0aab01fc8923125f380
- MD5 SHA1 SHA512
Malware Config
Signatures
- Downloads MZ/PE file
- Loads dropped DLL 3 IoCs
pid Process 3908 9770d8c263122462bd1443a3a1ba6f1e.exe 3908 9770d8c263122462bd1443a3a1ba6f1e.exe 3908 9770d8c263122462bd1443a3a1ba6f1e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Program crash 8 IoCs
pid pid_target Process procid_target 3912 3908 WerFault.exe 68 3844 3908 WerFault.exe 68 1536 3908 WerFault.exe 68 3372 3908 WerFault.exe 68 3120 3908 WerFault.exe 68 3952 3908 WerFault.exe 68 4044 3908 WerFault.exe 68 744 3908 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 3912 WerFault.exe Token: SeBackupPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 1536 WerFault.exe Token: SeDebugPrivilege 3372 WerFault.exe Token: SeDebugPrivilege 3120 WerFault.exe Token: SeDebugPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 4044 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9770d8c263122462bd1443a3a1ba6f1e.exe"C:\Users\Admin\AppData\Local\Temp\9770d8c263122462bd1443a3a1ba6f1e.exe"1⤵
- Loads dropped DLL
PID:3908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 8002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 9082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 9522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 11322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 10962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 11242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12882⤵
- Program crash
PID:744
-