Analysis
-
max time kernel
101s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 20:40
Static task
static1
General
-
Target
ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe
-
Size
1.5MB
-
MD5
be1caab1917f18e9fd1528964c17463a
-
SHA1
5faa3398d98c728c00841015dfc48afd7a5d1ca8
-
SHA256
ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e
-
SHA512
8aac4c98a065ef177ca9791b96a068d9c65d95b87f7f0c3b32e5fe86868e08e0a95ce9f4b9d475e1aafae5061431c2f6491b2664a1540e2341834a473db26788
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4220 created 4796 4220 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4796-116-0x0000000000400000-0x000000000057E000-memory.dmp family_vidar behavioral1/memory/4796-115-0x0000000002B40000-0x0000000002C5B000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exepid process 4796 ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4796 ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4884 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4916 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4952 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4984 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 5028 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 5056 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 5084 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4104 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 360 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 1520 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 3532 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 3584 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe 4220 4796 WerFault.exe ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4884 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4916 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4952 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 4984 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe 5028 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 4884 WerFault.exe Token: SeBackupPrivilege 4884 WerFault.exe Token: SeDebugPrivilege 4884 WerFault.exe Token: SeDebugPrivilege 4916 WerFault.exe Token: SeDebugPrivilege 4952 WerFault.exe Token: SeDebugPrivilege 4984 WerFault.exe Token: SeDebugPrivilege 5028 WerFault.exe Token: SeDebugPrivilege 5056 WerFault.exe Token: SeDebugPrivilege 5084 WerFault.exe Token: SeDebugPrivilege 4104 WerFault.exe Token: SeDebugPrivilege 360 WerFault.exe Token: SeDebugPrivilege 1520 WerFault.exe Token: SeDebugPrivilege 3532 WerFault.exe Token: SeDebugPrivilege 3584 WerFault.exe Token: SeDebugPrivilege 4220 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe"C:\Users\Admin\AppData\Local\Temp\ba9161ce0bff0251c559b9101399e5a47366e47eba02b58560ef4aba528b512e.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 9202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 10442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 10762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 15002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 16362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 16722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 17122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 17122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 14602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 14722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 17242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 17602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 14762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/4796-114-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4796-116-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/4796-115-0x0000000002B40000-0x0000000002C5B000-memory.dmpFilesize
1.1MB