Analysis
-
max time kernel
82s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-05-2022 08:16
Static task
static1
Behavioral task
behavioral1
Sample
977e303c6f1bb0f17d7bf2395fbd54ce.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
977e303c6f1bb0f17d7bf2395fbd54ce.exe
-
Size
433KB
-
MD5
977e303c6f1bb0f17d7bf2395fbd54ce
-
SHA1
f0ac19af16f8afa8023be0bd7f3506a33cfc25cb
-
SHA256
39e86dd37c077329a6c8e5f74816c2becd12d07cef0c5b85a6c7fa26f11e10b8
-
SHA512
58a604df0dbf833b8d028b08c6479c35747a82a2c3a748ede5bf4909a8b1ad79b2023f22b9470cd062179ce7935a5be1a41c2d1274be5ee45d250d73e86c1154
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2732 3116 WerFault.exe 977e303c6f1bb0f17d7bf2395fbd54ce.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
977e303c6f1bb0f17d7bf2395fbd54ce.exepid process 3116 977e303c6f1bb0f17d7bf2395fbd54ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
977e303c6f1bb0f17d7bf2395fbd54ce.exedescription pid process Token: SeDebugPrivilege 3116 977e303c6f1bb0f17d7bf2395fbd54ce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\977e303c6f1bb0f17d7bf2395fbd54ce.exe"C:\Users\Admin\AppData\Local\Temp\977e303c6f1bb0f17d7bf2395fbd54ce.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 19322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3116 -ip 31161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-130-0x0000000000787000-0x00000000007B1000-memory.dmpFilesize
168KB
-
memory/3116-131-0x0000000000720000-0x0000000000757000-memory.dmpFilesize
220KB
-
memory/3116-132-0x0000000004B90000-0x0000000005134000-memory.dmpFilesize
5.6MB
-
memory/3116-133-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/3116-134-0x0000000005170000-0x0000000005788000-memory.dmpFilesize
6.1MB
-
memory/3116-135-0x0000000005830000-0x0000000005842000-memory.dmpFilesize
72KB
-
memory/3116-136-0x0000000005850000-0x000000000595A000-memory.dmpFilesize
1.0MB
-
memory/3116-137-0x0000000005960000-0x000000000599C000-memory.dmpFilesize
240KB
-
memory/3116-138-0x00000000068D0000-0x0000000006946000-memory.dmpFilesize
472KB
-
memory/3116-139-0x0000000006990000-0x0000000006A22000-memory.dmpFilesize
584KB
-
memory/3116-140-0x0000000006AB0000-0x0000000006ACE000-memory.dmpFilesize
120KB
-
memory/3116-141-0x0000000006CA0000-0x0000000006D06000-memory.dmpFilesize
408KB
-
memory/3116-142-0x00000000070C0000-0x0000000007282000-memory.dmpFilesize
1.8MB
-
memory/3116-143-0x00000000074A0000-0x00000000079CC000-memory.dmpFilesize
5.2MB