Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 13:32
Static task
static1
General
-
Target
def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe
-
Size
1.5MB
-
MD5
fa0fc4e438328d168f869cf58bbd671f
-
SHA1
6f4f2a7b8e5c8cb7e01c81cfa80c400cfc1c8210
-
SHA256
def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496
-
SHA512
be5cee43ad9a624c51b8e45d27f0c5ad4007dc1f2a7aa38792ab913898fe305150bc5578454ded9a98b9ec2cafa0ec23eae08b396cbf4cc8483d1f2687837298
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 804 created 2372 804 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-116-0x0000000002A60000-0x0000000002B7B000-memory.dmp family_vidar behavioral1/memory/2372-117-0x0000000000400000-0x000000000057E000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exepid process 2372 def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 2372 def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2904 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 3780 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 2192 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 2288 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1644 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1860 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 604 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1256 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1056 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1516 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 1300 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 2924 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe 804 2372 WerFault.exe def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 2288 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2904 WerFault.exe Token: SeBackupPrivilege 2904 WerFault.exe Token: SeDebugPrivilege 2904 WerFault.exe Token: SeDebugPrivilege 3780 WerFault.exe Token: SeDebugPrivilege 2192 WerFault.exe Token: SeDebugPrivilege 2288 WerFault.exe Token: SeDebugPrivilege 1644 WerFault.exe Token: SeDebugPrivilege 1860 WerFault.exe Token: SeDebugPrivilege 604 WerFault.exe Token: SeDebugPrivilege 1256 WerFault.exe Token: SeDebugPrivilege 1056 WerFault.exe Token: SeDebugPrivilege 1516 WerFault.exe Token: SeDebugPrivilege 1300 WerFault.exe Token: SeDebugPrivilege 2924 WerFault.exe Token: SeDebugPrivilege 804 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe"C:\Users\Admin\AppData\Local\Temp\def4055093a8c99192cfd87e5dc5ead65ade8b59782aa7cd0044ef9fad8eb496.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 9482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 10562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 10682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 15042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 17242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 16322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 14962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 14922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 14562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 14762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 17002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 17802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 16762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/2372-115-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/2372-116-0x0000000002A60000-0x0000000002B7B000-memory.dmpFilesize
1.1MB
-
memory/2372-117-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB