Analysis
-
max time kernel
124s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-01-2022 10:32
Static task
static1
Behavioral task
behavioral1
Sample
6b8579744d4f9a2200a1e090181e4d6e.exe
Resource
win7-en-20211208
General
-
Target
6b8579744d4f9a2200a1e090181e4d6e.exe
-
Size
409KB
-
MD5
6b8579744d4f9a2200a1e090181e4d6e
-
SHA1
130a983fc16bdcb13b4a119a30e0162304f540f0
-
SHA256
558e3327ff438b57d187561ff840813f5087392a0bcbd26c918645d9dde26f19
-
SHA512
aa8078e1ff3a13f317acb9766ccb1ce03f7285f78431988710691cb2c3a590adbd0f97a8ccb88f77c180c8f31585aef118d0a60d6e247dbf02cb38e4bbad8e8e
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1360 created 3856 1360 WerFault.exe 6b8579744d4f9a2200a1e090181e4d6e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3116 3856 WerFault.exe 6b8579744d4f9a2200a1e090181e4d6e.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
WerFault.exepid process 3116 WerFault.exe 3116 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6b8579744d4f9a2200a1e090181e4d6e.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3856 6b8579744d4f9a2200a1e090181e4d6e.exe Token: SeRestorePrivilege 3116 WerFault.exe Token: SeBackupPrivilege 3116 WerFault.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WerFault.exedescription pid process target process PID 1360 wrote to memory of 3856 1360 WerFault.exe 6b8579744d4f9a2200a1e090181e4d6e.exe PID 1360 wrote to memory of 3856 1360 WerFault.exe 6b8579744d4f9a2200a1e090181e4d6e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b8579744d4f9a2200a1e090181e4d6e.exe"C:\Users\Admin\AppData\Local\Temp\6b8579744d4f9a2200a1e090181e4d6e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 11322⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3856 -ip 38561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3856-133-0x00000000004D0000-0x00000000004FB000-memory.dmpFilesize
172KB
-
memory/3856-134-0x0000000000920000-0x0000000000959000-memory.dmpFilesize
228KB
-
memory/3856-135-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3856-137-0x0000000004DC2000-0x0000000004DC3000-memory.dmpFilesize
4KB
-
memory/3856-136-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/3856-138-0x0000000004DC3000-0x0000000004DC4000-memory.dmpFilesize
4KB
-
memory/3856-139-0x0000000004DD0000-0x0000000005374000-memory.dmpFilesize
5.6MB
-
memory/3856-140-0x0000000005380000-0x0000000005998000-memory.dmpFilesize
6.1MB
-
memory/3856-141-0x0000000004C50000-0x0000000004C62000-memory.dmpFilesize
72KB
-
memory/3856-142-0x0000000004C70000-0x0000000004D7A000-memory.dmpFilesize
1.0MB
-
memory/3856-143-0x00000000059A0000-0x00000000059DC000-memory.dmpFilesize
240KB
-
memory/3856-144-0x0000000004C00000-0x0000000004DC6000-memory.dmpFilesize
1.8MB
-
memory/3856-145-0x0000000005CA0000-0x0000000005D16000-memory.dmpFilesize
472KB
-
memory/3856-146-0x0000000005D20000-0x0000000005DB2000-memory.dmpFilesize
584KB
-
memory/3856-147-0x0000000005E20000-0x0000000005E3E000-memory.dmpFilesize
120KB
-
memory/3856-148-0x0000000005FC0000-0x0000000006026000-memory.dmpFilesize
408KB
-
memory/3856-149-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/3856-150-0x00000000068C0000-0x0000000006DEC000-memory.dmpFilesize
5.2MB