6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923

General

Target

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
Size

397KB
MD5

f57e03dfe6b0a981f668cb3ce6bd934a
SHA1

2ed351b6aaeefa5d29fd01fc282cc488a1f3771d
SHA256

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923
SHA512

2c2a830129b1a475cecda37313b6a99f58076e1a6f70292a65ba1250204f3836602536da2816f4dd4fb837263e7bc0920ecba959b8c8be9e1d32729a387b3249

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1780 1648 WerFault.exe 6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

pid	pid_target	process	target process
1780	1648	WerFault.exe	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

pid	process
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

description pid process

Token: SeDebugPrivilege 1648 6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

description	pid	process
Token: SeDebugPrivilege	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

description	pid	process	target process
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	WerFault.exe
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	WerFault.exe
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	WerFault.exe
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
"C:\Users\Admin\AppData\Local\Temp\6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1352
2⤵
- Program crash
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-54-0x0000000000E30000-0x0000000000E9C000-memory.dmp

Filesize
432KB

Download
memory/1648-55-0x0000000000A90000-0x0000000000AEA000-memory.dmp

Filesize
360KB

Download
memory/1648-56-0x00000000755B1000-0x00000000755B3000-memory.dmp

Filesize
8KB

Download
memory/1780-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing