Analysis

  • max time kernel
    80s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 16:29

General

  • Target

    b0f15a5de3d2ad69a1758d34ef6e1c2e03299712c4b707877241f0a4dc2c4d94.exe

  • Size

    415KB

  • MD5

    8f72409a5891b12d5d9492c1f6541def

  • SHA1

    2331c1aa8d071675f9ab490dd8681267c4dd073a

  • SHA256

    b0f15a5de3d2ad69a1758d34ef6e1c2e03299712c4b707877241f0a4dc2c4d94

  • SHA512

    b306f52760f9ccf549381dbacc8362ecad80ede26777ad49fa2dc93e8ad78e3518373344b5fbaf0c0a6404ba3f9b97a6b9f578cc0b803620568a203bdb63bcdb

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0f15a5de3d2ad69a1758d34ef6e1c2e03299712c4b707877241f0a4dc2c4d94.exe
    "C:\Users\Admin\AppData\Local\Temp\b0f15a5de3d2ad69a1758d34ef6e1c2e03299712c4b707877241f0a4dc2c4d94.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1420
      2⤵
      • Program crash
      PID:4800
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4300 -ip 4300
    1⤵
      PID:1616
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
      1⤵
        PID:3152

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4300-130-0x00000000007F2000-0x000000000081E000-memory.dmp
        Filesize

        176KB

      • memory/4300-131-0x0000000000610000-0x000000000064A000-memory.dmp
        Filesize

        232KB

      • memory/4300-132-0x0000000000400000-0x00000000004A9000-memory.dmp
        Filesize

        676KB

      • memory/4300-133-0x0000000004CF0000-0x0000000005294000-memory.dmp
        Filesize

        5MB

      • memory/4300-134-0x00000000052A0000-0x00000000058B8000-memory.dmp
        Filesize

        6MB

      • memory/4300-135-0x0000000004C70000-0x0000000004C82000-memory.dmp
        Filesize

        72KB

      • memory/4300-136-0x00000000058C0000-0x00000000059CA000-memory.dmp
        Filesize

        1MB

      • memory/4300-137-0x00000000059D0000-0x0000000005A0C000-memory.dmp
        Filesize

        240KB

      • memory/4300-138-0x0000000005CB0000-0x0000000005D16000-memory.dmp
        Filesize

        408KB

      • memory/4300-139-0x0000000006350000-0x00000000063E2000-memory.dmp
        Filesize

        584KB

      • memory/4300-140-0x0000000006400000-0x0000000006476000-memory.dmp
        Filesize

        472KB

      • memory/4300-141-0x0000000006520000-0x000000000653E000-memory.dmp
        Filesize

        120KB

      • memory/4300-142-0x0000000006720000-0x00000000068E2000-memory.dmp
        Filesize

        1MB

      • memory/4300-143-0x00000000068F0000-0x0000000006E1C000-memory.dmp
        Filesize

        5MB