Analysis
- max time kernel
99s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/04/2022, 19:36
General
- Target c0f2e1952a76fd21a37639020cd5c2ae.exe
- Size 333KB
- Sample220425-ya74badad6
- SHA256 e01e773caf023020551eafca4fb9a708ad0daa39ba84dc87031a7da11dca86e4
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0f2e1952a76fd21a37639020cd5c2ae.exe"C:\Users\Admin\AppData\Local\Temp\c0f2e1952a76fd21a37639020cd5c2ae.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 15642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2076 -ip 20761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2076-130-0x00000000004CE000-0x00000000004F8000-memory.dmp
memory/2076-131-0x0000000004C40000-0x00000000051E4000-memory.dmp
memory/2076-132-0x00000000004CE000-0x00000000004F8000-memory.dmp
memory/2076-133-0x00000000021A0000-0x00000000021D7000-memory.dmp
memory/2076-134-0x0000000000400000-0x000000000045D000-memory.dmp
memory/2076-135-0x00000000051F0000-0x0000000005808000-memory.dmp
memory/2076-136-0x0000000004C00000-0x0000000004C12000-memory.dmp
memory/2076-137-0x0000000005810000-0x000000000591A000-memory.dmp
memory/2076-138-0x0000000004C34000-0x0000000004C36000-memory.dmp
memory/2076-139-0x0000000005920000-0x000000000595C000-memory.dmp
memory/2076-140-0x0000000005C20000-0x0000000005C96000-memory.dmp
memory/2076-141-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/2076-142-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/2076-143-0x0000000005F50000-0x0000000005FB6000-memory.dmp
memory/2076-144-0x00000000067A0000-0x0000000006962000-memory.dmp
memory/2076-145-0x0000000006970000-0x0000000006E9C000-memory.dmp