Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-05-2022 15:21
Static task
static1
Behavioral task
behavioral1
Sample
3fbdf844460430371300862dca04a638.exe
Resource
win7-20220414-en
General
-
Target
3fbdf844460430371300862dca04a638.exe
-
Size
413KB
-
MD5
3fbdf844460430371300862dca04a638
-
SHA1
a05576b034ccea63dd56566cb313ad596a6f2331
-
SHA256
9566ef0986d5c2065cddb538b348874c6c460b9d13f017aca76d2fb4e5ad061b
-
SHA512
e5fe393a66f661d362be87fffff3563dcaac417c3e5ecfabb59fbe8a75c74361168a1edba780ae59f3b525176be76dbd979dc589022930b5c56d37d7c0e36b55
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1440 1596 WerFault.exe 3fbdf844460430371300862dca04a638.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3fbdf844460430371300862dca04a638.exepid process 1596 3fbdf844460430371300862dca04a638.exe 1596 3fbdf844460430371300862dca04a638.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3fbdf844460430371300862dca04a638.exedescription pid process Token: SeDebugPrivilege 1596 3fbdf844460430371300862dca04a638.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fbdf844460430371300862dca04a638.exe"C:\Users\Admin\AppData\Local\Temp\3fbdf844460430371300862dca04a638.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 14442⤵
- Program crash
PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1596 -ip 15961⤵PID:484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1596-130-0x00000000005F2000-0x000000000061C000-memory.dmpFilesize
168KB
-
memory/1596-131-0x00000000020E0000-0x0000000002117000-memory.dmpFilesize
220KB
-
memory/1596-132-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/1596-133-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/1596-134-0x00000000050F0000-0x0000000005708000-memory.dmpFilesize
6.1MB
-
memory/1596-135-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1596-136-0x0000000005710000-0x000000000581A000-memory.dmpFilesize
1.0MB
-
memory/1596-137-0x0000000005820000-0x000000000585C000-memory.dmpFilesize
240KB
-
memory/1596-138-0x0000000006790000-0x0000000006806000-memory.dmpFilesize
472KB
-
memory/1596-139-0x0000000006850000-0x00000000068E2000-memory.dmpFilesize
584KB
-
memory/1596-140-0x0000000006970000-0x000000000698E000-memory.dmpFilesize
120KB
-
memory/1596-141-0x0000000006B20000-0x0000000006B86000-memory.dmpFilesize
408KB
-
memory/1596-142-0x00000000071A0000-0x0000000007362000-memory.dmpFilesize
1.8MB
-
memory/1596-143-0x0000000007370000-0x000000000789C000-memory.dmpFilesize
5.2MB
-
memory/1596-144-0x00000000005F2000-0x000000000061C000-memory.dmpFilesize
168KB
-
memory/1596-145-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB