Analysis
- max time kernel
141s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 23:33
General
- Target b01feb3d95ebf4015703cb40886aebeb.exe
- Size 367KB
- Sample220321-3jvlssacem
- SHA256 16097ef7d2a32abc1f569862ba55f782200186a940e8e2eafc5d55b2d61aaa5d
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01feb3d95ebf4015703cb40886aebeb.exe"C:\Users\Admin\AppData\Local\Temp\b01feb3d95ebf4015703cb40886aebeb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 13442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4604 -ip 46041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4604-134-0x0000000000848000-0x0000000000872000-memory.dmp
memory/4604-135-0x0000000000848000-0x0000000000872000-memory.dmp
memory/4604-136-0x00000000021D0000-0x0000000002207000-memory.dmp
memory/4604-137-0x0000000002370000-0x0000000002371000-memory.dmp
memory/4604-138-0x0000000000400000-0x0000000000488000-memory.dmp
memory/4604-139-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4604-140-0x0000000002372000-0x0000000002373000-memory.dmp
memory/4604-141-0x0000000002373000-0x0000000002374000-memory.dmp
memory/4604-142-0x0000000004CC0000-0x0000000005264000-memory.dmp
memory/4604-143-0x0000000005270000-0x0000000005888000-memory.dmp
memory/4604-144-0x0000000005890000-0x00000000058A2000-memory.dmp
memory/4604-145-0x00000000058B0000-0x00000000059BA000-memory.dmp
memory/4604-146-0x0000000002374000-0x0000000002376000-memory.dmp
memory/4604-147-0x0000000005A00000-0x0000000005A3C000-memory.dmp
memory/4604-148-0x0000000005CE0000-0x0000000005D56000-memory.dmp
memory/4604-149-0x0000000005D60000-0x0000000005DF2000-memory.dmp
memory/4604-150-0x0000000005F90000-0x0000000005FAE000-memory.dmp
memory/4604-151-0x0000000006000000-0x0000000006066000-memory.dmp
memory/4604-152-0x0000000007A00000-0x0000000007BC2000-memory.dmp
memory/4604-153-0x0000000007BD0000-0x00000000080FC000-memory.dmp