Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    20/11/2021, 07:56

General

  • Target

    10077bec9ee4408196ba97fa5bd3a2ff409ef9deddb183aeca757798ff68ec64.exe

  • Size

    4.5MB

  • MD5

    43dbb19672949c54bea088f785c39470

  • SHA1

    f625bb44935795cee20304e9f174c8121cd89c6e

  • SHA256

    10077bec9ee4408196ba97fa5bd3a2ff409ef9deddb183aeca757798ff68ec64

  • SHA512

    fc5fcc9c4d9a80d3d640405aeb3d66baf53853358824b32e4d99ea0562b1c5214bf28b48abe7f4a47a56d91ed7442453896b2c5cecede1a1ea37fa0e8c5f92d9

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10077bec9ee4408196ba97fa5bd3a2ff409ef9deddb183aeca757798ff68ec64.exe
    "C:\Users\Admin\AppData\Local\Temp\10077bec9ee4408196ba97fa5bd3a2ff409ef9deddb183aeca757798ff68ec64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vinmall_dj.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\vinmall_dj.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of AdjustPrivilegeToken
      PID:3908
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
      2⤵
      • Executes dropped EXE
      PID:4380
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 800
        3⤵
        • Drops file in Windows directory
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 812
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3308
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 912
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 948
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1232
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1276
        3⤵
        • Program crash
        PID:828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1224
        3⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1020

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3908-136-0x0000000005040000-0x0000000005048000-memory.dmp

          Filesize

          32KB

        • memory/3908-128-0x0000000003C10000-0x0000000003C20000-memory.dmp

          Filesize

          64KB

        • memory/3908-134-0x0000000004DA0000-0x0000000004DA8000-memory.dmp

          Filesize

          32KB

        • memory/3908-135-0x0000000005040000-0x0000000005048000-memory.dmp

          Filesize

          32KB

        • memory/3908-161-0x00000000049A0000-0x00000000049A8000-memory.dmp

          Filesize

          32KB

        • memory/3908-176-0x0000000004BA0000-0x0000000004BA8000-memory.dmp

          Filesize

          32KB

        • memory/3908-177-0x0000000004BA0000-0x0000000004BA8000-memory.dmp

          Filesize

          32KB

        • memory/3908-122-0x0000000003A70000-0x0000000003A80000-memory.dmp

          Filesize

          64KB

        • memory/3908-121-0x0000000000030000-0x0000000000033000-memory.dmp

          Filesize

          12KB

        • memory/4380-188-0x0000000000400000-0x0000000002B57000-memory.dmp

          Filesize

          39.3MB

        • memory/4380-187-0x0000000002C40000-0x0000000002D8A000-memory.dmp

          Filesize

          1.3MB