Analysis

  • max time kernel
    126s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    13-04-2022 19:46

General

  • Target

    c73492339fef05b6038b7cf92cfeeae22ba613d5d5e95601de03ab7b2ffb8b0d.exe

  • Size

    414KB

  • MD5

    c33a63009737b251cdd43881f2cd8164

  • SHA1

    84e0a60959b2dc6cbc95e67a7df644f150a31168

  • SHA256

    c73492339fef05b6038b7cf92cfeeae22ba613d5d5e95601de03ab7b2ffb8b0d

  • SHA512

    9239ae3516240f77995761aebe99dde37007fccfc9c96db4c1acb0dab4f8027e0f0d50dc2c64bbb035fe06c76e4ec8521af23dc99aab8e03254d7f399db19ebe

Malware Config

Signatures

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c73492339fef05b6038b7cf92cfeeae22ba613d5d5e95601de03ab7b2ffb8b0d.exe
    "C:\Users\Admin\AppData\Local\Temp\c73492339fef05b6038b7cf92cfeeae22ba613d5d5e95601de03ab7b2ffb8b0d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1424
      2⤵
      • Program crash
      PID:4632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3796 -ip 3796
    1⤵
      PID:4588

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3796-133-0x00000000006DC000-0x0000000000706000-memory.dmp

      Filesize

      168KB

    • memory/3796-134-0x00000000006DC000-0x0000000000706000-memory.dmp

      Filesize

      168KB

    • memory/3796-135-0x0000000000A10000-0x0000000000A47000-memory.dmp

      Filesize

      220KB

    • memory/3796-136-0x0000000000400000-0x0000000000472000-memory.dmp

      Filesize

      456KB

    • memory/3796-137-0x0000000004C40000-0x00000000051E4000-memory.dmp

      Filesize

      5.6MB

    • memory/3796-138-0x00000000051F0000-0x0000000005808000-memory.dmp

      Filesize

      6.1MB

    • memory/3796-139-0x0000000005810000-0x0000000005822000-memory.dmp

      Filesize

      72KB

    • memory/3796-140-0x0000000005830000-0x000000000593A000-memory.dmp

      Filesize

      1.0MB

    • memory/3796-141-0x0000000005A80000-0x0000000005ABC000-memory.dmp

      Filesize

      240KB

    • memory/3796-142-0x0000000002524000-0x0000000002526000-memory.dmp

      Filesize

      8KB

    • memory/3796-143-0x0000000005C60000-0x0000000005CF2000-memory.dmp

      Filesize

      584KB

    • memory/3796-144-0x0000000005D00000-0x0000000005D66000-memory.dmp

      Filesize

      408KB

    • memory/3796-145-0x0000000006420000-0x0000000006496000-memory.dmp

      Filesize

      472KB

    • memory/3796-146-0x00000000064F0000-0x000000000650E000-memory.dmp

      Filesize

      120KB

    • memory/3796-147-0x0000000007280000-0x0000000007442000-memory.dmp

      Filesize

      1.8MB

    • memory/3796-148-0x0000000007460000-0x000000000798C000-memory.dmp

      Filesize

      5.2MB