Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    13-05-2022 00:58

General

  • Target

    1d300ee007daf635408937a182017cb5.exe

  • Size

    379KB

  • MD5

    1d300ee007daf635408937a182017cb5

  • SHA1

    4f1d5e2da8f6d74acac2b9f8e5439a32521ff7f4

  • SHA256

    613e093fee97faa720fa9cf083a2966371df89389bc727b1f2ed57478db109a7

  • SHA512

    046b02c0174c3faf098d186e343fe0d059b669005bc247cfac59e3543d4d47d1ca3cd2e1848bee8c09461e660340c0d074e05c85bdc65fd0cf86a5f1df43a7e1

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d300ee007daf635408937a182017cb5.exe
    "C:\Users\Admin\AppData\Local\Temp\1d300ee007daf635408937a182017cb5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1356
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1248
      2⤵
      • Program crash
      PID:4424
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1356 -ip 1356
    1⤵
      PID:3272

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1356-130-0x0000000004CE0000-0x0000000005284000-memory.dmp
      Filesize

      5.6MB

    • memory/1356-131-0x0000000000788000-0x00000000007B2000-memory.dmp
      Filesize

      168KB

    • memory/1356-132-0x0000000000700000-0x0000000000737000-memory.dmp
      Filesize

      220KB

    • memory/1356-133-0x0000000000400000-0x00000000004AE000-memory.dmp
      Filesize

      696KB

    • memory/1356-134-0x0000000005290000-0x00000000058A8000-memory.dmp
      Filesize

      6.1MB

    • memory/1356-135-0x0000000004B20000-0x0000000004B32000-memory.dmp
      Filesize

      72KB

    • memory/1356-136-0x0000000004B40000-0x0000000004C4A000-memory.dmp
      Filesize

      1.0MB

    • memory/1356-137-0x0000000004C50000-0x0000000004C8C000-memory.dmp
      Filesize

      240KB

    • memory/1356-138-0x0000000005A30000-0x0000000005A96000-memory.dmp
      Filesize

      408KB

    • memory/1356-139-0x0000000006310000-0x00000000063A2000-memory.dmp
      Filesize

      584KB

    • memory/1356-140-0x00000000063B0000-0x0000000006426000-memory.dmp
      Filesize

      472KB

    • memory/1356-141-0x00000000064C0000-0x00000000064DE000-memory.dmp
      Filesize

      120KB

    • memory/1356-142-0x0000000007260000-0x00000000072B0000-memory.dmp
      Filesize

      320KB

    • memory/1356-143-0x00000000066B0000-0x0000000006872000-memory.dmp
      Filesize

      1.8MB

    • memory/1356-144-0x0000000006890000-0x0000000006DBC000-memory.dmp
      Filesize

      5.2MB