1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f

Analysis

Target

1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe
Size

93KB
MD5

68958ce8e51a4b8dd6ff8b8a57515be2
SHA1

d88289eab220b4d8e3dbe4f9f2ce3539105d3c4a
SHA256

1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f
SHA512

a3b858721fb2060bf413edf4a893a8d6e860857225bad60d7c3a5be57f672f63d71582d30ace1ed881c57ef6d47a2f196c2b2c135cb4ce86d4015332585484b4

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

976 1404 WerFault.exe 1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

976 WerFault.exe
976 WerFault.exe
976 WerFault.exe
976 WerFault.exe
976 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

976 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 976 WerFault.exe

pid	pid_target	process	target process
976	1404	WerFault.exe	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe

pid	process
976	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	976	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe

description	pid	process	target process
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	WerFault.exe
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	WerFault.exe
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	WerFault.exe
PID 1404 wrote to memory of 976	1404	1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe
"C:\Users\Admin\AppData\Local\Temp\1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 776
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/976-56-0x0000000000580000-0x000000000059C000-memory.dmp

Filesize
112KB

Download
memory/1404-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download