Analysis
-
max time kernel
91s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 16:02
Static task
static1
General
-
Target
dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe
-
Size
407KB
-
MD5
7c4c6fc4d6df19db0b3fb4d8273c6cd4
-
SHA1
f839b42fc625cbea2f5e47e48d29f1ba1f30a559
-
SHA256
dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90
-
SHA512
44fde129e9ccc1919782950c4935d6ad8a48ce13e2ea1e5970bbafc45cf96c775b8083c0203003464564258a0c826b3a5ea5468560b6021607a498a11bb163b6
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3652 4304 WerFault.exe dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exepid process 4304 dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe 4304 dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exedescription pid process Token: SeDebugPrivilege 4304 dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe"C:\Users\Admin\AppData\Local\Temp\dd7136c20a28da9087a7bc8604d0e18d3b455b3c697285a5826409e68c9eab90.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 12402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4304 -ip 43041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4304-130-0x0000000000612000-0x000000000063C000-memory.dmpFilesize
168KB
-
memory/4304-131-0x00000000020E0000-0x0000000002117000-memory.dmpFilesize
220KB
-
memory/4304-132-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/4304-133-0x0000000004C90000-0x0000000005234000-memory.dmpFilesize
5.6MB
-
memory/4304-134-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/4304-135-0x0000000004C50000-0x0000000004C62000-memory.dmpFilesize
72KB
-
memory/4304-136-0x0000000005860000-0x000000000596A000-memory.dmpFilesize
1.0MB
-
memory/4304-137-0x0000000005970000-0x00000000059AC000-memory.dmpFilesize
240KB
-
memory/4304-138-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/4304-139-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/4304-140-0x0000000006430000-0x00000000064C2000-memory.dmpFilesize
584KB
-
memory/4304-141-0x0000000006510000-0x000000000652E000-memory.dmpFilesize
120KB
-
memory/4304-142-0x0000000006950000-0x0000000006B12000-memory.dmpFilesize
1.8MB
-
memory/4304-143-0x0000000006B20000-0x000000000704C000-memory.dmpFilesize
5.2MB