6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923

Analysis

Target

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
Size

397KB
MD5

f57e03dfe6b0a981f668cb3ce6bd934a
SHA1

2ed351b6aaeefa5d29fd01fc282cc488a1f3771d
SHA256

6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923
SHA512

2c2a830129b1a475cecda37313b6a99f58076e1a6f70292a65ba1250204f3836602536da2816f4dd4fb837263e7bc0920ecba959b8c8be9e1d32729a387b3249

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1648	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	28
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	28
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	28
PID 1648 wrote to memory of 1780	1648	6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe	28

C:\Users\Admin\AppData\Local\Temp\6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe
"C:\Users\Admin\AppData\Local\Temp\6bed5241b11118203214ece29505879b089981f3765cb93417d5e1fb0ff26923.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1352
  2⤵
  - Program crash
  PID:1780

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1648-54-0x0000000000E30000-0x0000000000E9C000-memory.dmp

Filesize
432KB

Download
memory/1648-55-0x0000000000A90000-0x0000000000AEA000-memory.dmp

Filesize
360KB

Download
memory/1648-56-0x00000000755B1000-0x00000000755B3000-memory.dmp

Filesize
8KB

Download