861f82115decc24bbcc0a1584d3d360b2207a0b24677fb27413ce4af203197a1

General

Target

SetupMEXX.exe
Size

388KB
MD5

fd36ead9a941217680b213e704ecc74e
SHA1

436723768cf5e4cc208e11ccb940cca7909ec9ce
SHA256

861f82115decc24bbcc0a1584d3d360b2207a0b24677fb27413ce4af203197a1
SHA512

1d5989fced99eab745d5af098579d8f1a25b4b86d6a2415afffbc1ce4d5392a8f2b9e6411da3cdd242faad87d4aa2b920cbf02ee3b2fb20bc608c159e2b90db3

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 2704 WerFault.exe SetupMEXX.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SetupMEXX.exe

pid process

2704 SetupMEXX.exe
2704 SetupMEXX.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SetupMEXX.exe

description pid process

Token: SeDebugPrivilege 2704 SetupMEXX.exe

pid	pid_target	process	target process
2124	2704	WerFault.exe	SetupMEXX.exe

pid	process
2704	SetupMEXX.exe
2704	SetupMEXX.exe

description	pid	process
Token: SeDebugPrivilege	2704	SetupMEXX.exe

C:\Users\Admin\AppData\Local\Temp\SetupMEXX.exe
"C:\Users\Admin\AppData\Local\Temp\SetupMEXX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1772
2⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2704 -ip 2704
1⤵
PID:8

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-130-0x0000000000CA3000-0x0000000000CCD000-memory.dmp

Filesize
168KB

Download
memory/2704-131-0x0000000000C10000-0x0000000000C47000-memory.dmp

Filesize
220KB

Download
memory/2704-132-0x0000000000400000-0x0000000000B54000-memory.dmp

Filesize
7.3MB

Download
memory/2704-133-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/2704-134-0x0000000005890000-0x0000000005EA8000-memory.dmp

Filesize
6.1MB

Download
memory/2704-135-0x0000000005EF0000-0x0000000005F02000-memory.dmp

Filesize
72KB

Download
memory/2704-136-0x0000000005F10000-0x000000000601A000-memory.dmp

Filesize
1.0MB

Download
memory/2704-137-0x0000000006060000-0x000000000609C000-memory.dmp

Filesize
240KB

Download
memory/2704-138-0x0000000006340000-0x00000000063B6000-memory.dmp

Filesize
472KB

Download
memory/2704-139-0x00000000063C0000-0x0000000006452000-memory.dmp

Filesize
584KB

Download
memory/2704-140-0x00000000064E0000-0x00000000064FE000-memory.dmp

Filesize
120KB

Download
memory/2704-141-0x0000000006670000-0x00000000066D6000-memory.dmp

Filesize
408KB

Download
memory/2704-142-0x0000000006DB0000-0x0000000006F72000-memory.dmp

Filesize
1.8MB

Download
memory/2704-143-0x0000000006F80000-0x00000000074AC000-memory.dmp

Filesize
5.2MB

Download
memory/2704-144-0x0000000000CA3000-0x0000000000CCD000-memory.dmp

Filesize
168KB

Download
memory/2704-145-0x0000000000400000-0x0000000000B54000-memory.dmp

Filesize
7.3MB

Download
memory/2704-146-0x0000000000CA3000-0x0000000000CCD000-memory.dmp

Filesize
168KB

Download
memory/2704-147-0x0000000000400000-0x0000000000B54000-memory.dmp

Filesize
7.3MB

Download

Analysis

Sharing