1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f

Analysis

Target

1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe
Size

93KB
MD5

68958ce8e51a4b8dd6ff8b8a57515be2
SHA1

d88289eab220b4d8e3dbe4f9f2ce3539105d3c4a
SHA256

1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f
SHA512

a3b858721fb2060bf413edf4a893a8d6e860857225bad60d7c3a5be57f672f63d71582d30ace1ed881c57ef6d47a2f196c2b2c135cb4ce86d4015332585484b4

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1404	WerFault.exe	10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
976	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	28
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	28
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	28
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	28

C:\Users\Admin\AppData\Local\Temp\1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe
"C:\Users\Admin\AppData\Local\Temp\1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 776
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/976-56-0x0000000000580000-0x000000000059C000-memory.dmp

Filesize
112KB

Download
memory/1404-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download