Analysis

  • max time kernel
    91s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 16:02

General

  • Target

    dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe

  • Size

    407KB

  • MD5

    7c4c6fc4d6df19db0b3fb4d8273c6cd4

  • SHA1

    f839b42fc625cbea2f5e47e48d29f1ba1f30a559

  • SHA256

    dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90

  • SHA512

    44fde129e9ccc1919782950c4935d6ad8a48ce13e2ea1e5970bbafc45cf96c775b8083c0203003464564258a0c826b3a5ea5468560b6021607a498a11bb163b6

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe
    "C:\Users\Admin\AppData\Local\Temp\dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 1240
      2⤵
      • Program crash
      PID:3652
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4304 -ip 4304
    1⤵
      PID:1520

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4304-130-0x0000000000612000-0x000000000063C000-memory.dmp
      Filesize

      168KB

    • memory/4304-131-0x00000000020E0000-0x0000000002117000-memory.dmp
      Filesize

      220KB

    • memory/4304-132-0x0000000000400000-0x00000000004A7000-memory.dmp
      Filesize

      668KB

    • memory/4304-133-0x0000000004C90000-0x0000000005234000-memory.dmp
      Filesize

      5.6MB

    • memory/4304-134-0x0000000005240000-0x0000000005858000-memory.dmp
      Filesize

      6.1MB

    • memory/4304-135-0x0000000004C50000-0x0000000004C62000-memory.dmp
      Filesize

      72KB

    • memory/4304-136-0x0000000005860000-0x000000000596A000-memory.dmp
      Filesize

      1.0MB

    • memory/4304-137-0x0000000005970000-0x00000000059AC000-memory.dmp
      Filesize

      240KB

    • memory/4304-138-0x0000000005C70000-0x0000000005CD6000-memory.dmp
      Filesize

      408KB

    • memory/4304-139-0x0000000006350000-0x00000000063C6000-memory.dmp
      Filesize

      472KB

    • memory/4304-140-0x0000000006430000-0x00000000064C2000-memory.dmp
      Filesize

      584KB

    • memory/4304-141-0x0000000006510000-0x000000000652E000-memory.dmp
      Filesize

      120KB

    • memory/4304-142-0x0000000006950000-0x0000000006B12000-memory.dmp
      Filesize

      1.8MB

    • memory/4304-143-0x0000000006B20000-0x000000000704C000-memory.dmp
      Filesize

      5.2MB