Analysis
- max time kernel
136s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 10:17
General
- Target 2f79b70458c2dc473d74107f577f0100.exe
- Size 407KB
- Sample220321-mbc4sabeem
- SHA256 a426c2090b8c2777661236aa54ce8eb143af9cc4c1aa8aa11261c6758a970921
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f79b70458c2dc473d74107f577f0100.exe"C:\Users\Admin\AppData\Local\Temp\2f79b70458c2dc473d74107f577f0100.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 18722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3268 -ip 32681⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3268-130-0x00000000006CD000-0x00000000006F9000-memory.dmp
memory/3268-131-0x0000000004C40000-0x00000000051E4000-memory.dmp
memory/3268-132-0x00000000006CD000-0x00000000006F9000-memory.dmp
memory/3268-133-0x0000000000600000-0x000000000063A000-memory.dmp
memory/3268-134-0x0000000000400000-0x0000000000492000-memory.dmp
memory/3268-135-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/3268-136-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/3268-137-0x0000000004C32000-0x0000000004C33000-memory.dmp
memory/3268-138-0x0000000004C33000-0x0000000004C34000-memory.dmp
memory/3268-139-0x00000000051F0000-0x0000000005808000-memory.dmp
memory/3268-140-0x0000000004B90000-0x0000000004BA2000-memory.dmp
memory/3268-141-0x0000000005810000-0x000000000591A000-memory.dmp
memory/3268-142-0x0000000004BE0000-0x0000000004C1C000-memory.dmp
memory/3268-143-0x0000000004C34000-0x0000000004C36000-memory.dmp
memory/3268-144-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/3268-145-0x0000000006270000-0x0000000006302000-memory.dmp
memory/3268-146-0x0000000006320000-0x0000000006396000-memory.dmp
memory/3268-147-0x0000000006440000-0x000000000645E000-memory.dmp
memory/3268-148-0x00000000071E0000-0x00000000073A2000-memory.dmp
memory/3268-149-0x00000000073C0000-0x00000000078EC000-memory.dmp
memory/3268-150-0x0000000007A20000-0x0000000007A70000-memory.dmp