Analysis
- max time kernel
91s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 03:30
General
- Target a2e8bed72837f55df3881ee10030eb13.exe
- Size 414KB
- Sample220521-d2gp8abffr
- SHA256 e7a690dae9484e6f3cf049e4d09f4a22c98ff9eaa2fd7f363630907ed56f00ce
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2e8bed72837f55df3881ee10030eb13.exe"C:\Users\Admin\AppData\Local\Temp\a2e8bed72837f55df3881ee10030eb13.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 12602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4744 -ip 47441⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4744-130-0x0000000000672000-0x000000000069E000-memory.dmp
memory/4744-131-0x0000000000610000-0x0000000000649000-memory.dmp
memory/4744-132-0x0000000000400000-0x00000000004A9000-memory.dmp
memory/4744-133-0x0000000004D90000-0x0000000005334000-memory.dmp
memory/4744-134-0x0000000005340000-0x0000000005958000-memory.dmp
memory/4744-135-0x0000000004C60000-0x0000000004C72000-memory.dmp
memory/4744-136-0x0000000005960000-0x0000000005A6A000-memory.dmp
memory/4744-137-0x0000000004CB0000-0x0000000004CEC000-memory.dmp
memory/4744-138-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/4744-139-0x00000000064A0000-0x0000000006516000-memory.dmp
memory/4744-140-0x0000000006550000-0x00000000065E2000-memory.dmp
memory/4744-141-0x0000000006660000-0x000000000667E000-memory.dmp
memory/4744-142-0x0000000006820000-0x00000000069E2000-memory.dmp
memory/4744-143-0x0000000006A00000-0x0000000006F2C000-memory.dmp