5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473

Analysis

Target

5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe
Size

93KB
MD5

5d51deb0099b217cd65c3653f8c619cd
SHA1

90d3b8eff6389c9b5c88537f9f9f1c52d66108b6
SHA256

5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473
SHA512

203b39d29d30df7666c04c1d624d3c8e951174ec3f942982ae352bcc8cc1c5e8930bcfca572bbe0b23c6b7086a9bf4254e553ec7a1a53a96a1520090242f0ecc

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

572 612 WerFault.exe 5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

572 WerFault.exe
572 WerFault.exe
572 WerFault.exe
572 WerFault.exe
572 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 572 WerFault.exe

pid	pid_target	process	target process
572	612	WerFault.exe	5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe

description	pid	process
Token: SeDebugPrivilege	572	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe

description	pid	process	target process
PID 612 wrote to memory of 572	612	5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe	WerFault.exe
PID 612 wrote to memory of 572	612	5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe	WerFault.exe
PID 612 wrote to memory of 572	612	5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe	WerFault.exe
PID 612 wrote to memory of 572	612	5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe
"C:\Users\Admin\AppData\Local\Temp\5ede1d8507ccf9456191b7f187078546a84b091a968f28833d8da1d24a1cf473.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 688
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/572-57-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/612-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download