Analysis
- max time kernel
124s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
11/03/2022, 14:32
General
- Target ce3a73f1f3d9c74213525f40dd6205a6.exe
- Size 416KB
- Sample220311-rwallschck
- SHA256 ca096eda6c30a97f4ced9747365a6b6498e57db0dde8bac3453f68c85dfe0e60
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce3a73f1f3d9c74213525f40dd6205a6.exe"C:\Users\Admin\AppData\Local\Temp\ce3a73f1f3d9c74213525f40dd6205a6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 12562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 636 -ip 6361⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-134-0x00000000006E8000-0x0000000000714000-memory.dmp
memory/636-135-0x00000000006E8000-0x0000000000714000-memory.dmp
memory/636-136-0x0000000000690000-0x00000000006C9000-memory.dmp
memory/636-137-0x0000000000400000-0x00000000004F5000-memory.dmp
memory/636-139-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/636-138-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/636-140-0x0000000004C70000-0x0000000005214000-memory.dmp
memory/636-141-0x0000000004C62000-0x0000000004C63000-memory.dmp
memory/636-142-0x0000000004C63000-0x0000000004C64000-memory.dmp
memory/636-143-0x0000000005290000-0x00000000058A8000-memory.dmp
memory/636-144-0x0000000005910000-0x0000000005922000-memory.dmp
memory/636-145-0x0000000005930000-0x0000000005A3A000-memory.dmp
memory/636-146-0x0000000005A60000-0x0000000005A9C000-memory.dmp
memory/636-147-0x0000000004C64000-0x0000000004C66000-memory.dmp
memory/636-148-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/636-149-0x0000000006550000-0x00000000065E2000-memory.dmp
memory/636-150-0x0000000006600000-0x0000000006676000-memory.dmp
memory/636-151-0x0000000006720000-0x000000000673E000-memory.dmp
memory/636-152-0x0000000006920000-0x0000000006AE2000-memory.dmp
memory/636-153-0x0000000006AF0000-0x000000000701C000-memory.dmp