c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240

General

Target

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
Size

5.0MB
MD5

dbe9736b562b2bcce0b531fdfeaded32
SHA1

a36ac4af321f97964885b801601aaee816f405d1
SHA256

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240
SHA512

9dc69b482a510482b6aa6992924daf39b96bb43ab9017d6919120288e3d7936717b21aa24cd12c51d64d446eecc626bdc0ddfd0222cff5fde8010d110edea849

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpc920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpevreporter.exe

pid	process
1316	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
2112	evreporter.exe

Loads dropped DLL 1 IoCs

Processes:

evreporter.exe

pid process

2112 evreporter.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3444 2112 WerFault.exe evreporter.exe

pid	process
2112	evreporter.exe

pid	pid_target	process	target process
3444	2112	WerFault.exe	evreporter.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpWerFault.exe

pid	process
820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3444 WerFault.exe
Token: SeBackupPrivilege 3444 WerFault.exe
Token: SeDebugPrivilege 3444 WerFault.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

pid process

820 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

description	pid	process
Token: SeRestorePrivilege	3444	WerFault.exe
Token: SeBackupPrivilege	3444	WerFault.exe
Token: SeDebugPrivilege	3444	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpc920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

description	pid	process	target process
PID 3108 wrote to memory of 1316	3108	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 3108 wrote to memory of 1316	3108	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 3108 wrote to memory of 1316	3108	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1316 wrote to memory of 2240	1316	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1316 wrote to memory of 2240	1316	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1316 wrote to memory of 2240	1316	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 2240 wrote to memory of 820	2240	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 2240 wrote to memory of 820	2240	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 2240 wrote to memory of 820	2240	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 820 wrote to memory of 2112	820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe
PID 820 wrote to memory of 2112	820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe
PID 820 wrote to memory of 2112	820	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe

C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Local\Temp\is-UR86I.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UR86I.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$30112,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
3⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\is-8H9PS.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8H9PS.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$40112,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:820

C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
"C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1264
6⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8H9PS.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UR86I.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll
MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui
MD5
95518f5e98099572bede73302c79c7bd

SHA1
6168202123dca8fbc4a8e688561b5b18d51a462e

SHA256
115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

SHA512
a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll
MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
memory/820-124-0x0000000000000000-mapping.dmp

Download
memory/820-127-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1316-120-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1316-118-0x0000000000000000-mapping.dmp

Download
memory/2112-128-0x0000000000000000-mapping.dmp

Download
memory/2240-126-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2240-121-0x0000000000000000-mapping.dmp

Download
memory/3108-117-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads