Analysis
- max time kernel
77s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/04/2022, 00:06
General
- Target b5465a2d959c7754872ddd25cea5dd19.exe
- Size 309KB
- Sample220425-adqrfaedcl
- SHA256 65d34bb93bbf798c0ac201cd4deb8abd0eed29453f95d53306bf05824f629fdc
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5465a2d959c7754872ddd25cea5dd19.exe"C:\Users\Admin\AppData\Local\Temp\b5465a2d959c7754872ddd25cea5dd19.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2392 -ip 23921⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2392-130-0x00000000006FC000-0x0000000000726000-memory.dmp
memory/2392-131-0x00000000020A0000-0x00000000020D7000-memory.dmp
memory/2392-132-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2392-133-0x0000000004B20000-0x00000000050C4000-memory.dmp
memory/2392-134-0x00000000050D0000-0x00000000056E8000-memory.dmp
memory/2392-135-0x0000000004AC0000-0x0000000004AD2000-memory.dmp
memory/2392-136-0x00000000056F0000-0x00000000057FA000-memory.dmp
memory/2392-137-0x0000000005800000-0x000000000583C000-memory.dmp
memory/2392-138-0x0000000005AE0000-0x0000000005B56000-memory.dmp
memory/2392-139-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/2392-140-0x0000000005D90000-0x0000000005DAE000-memory.dmp
memory/2392-141-0x0000000005E10000-0x0000000005E76000-memory.dmp
memory/2392-142-0x0000000006540000-0x0000000006702000-memory.dmp
memory/2392-143-0x0000000006710000-0x0000000006C3C000-memory.dmp