653d5351b00090f3574a9e6406cf17b0646887f17c404e3665ec645d1c3e9e68

General

Target

cbe17c61a228c74d2df1e36ad7232ac8.exe
Size

399KB
MD5

cbe17c61a228c74d2df1e36ad7232ac8
SHA1

bec62bcd1cacd592b3197e2ac9265a6943106e08
SHA256

653d5351b00090f3574a9e6406cf17b0646887f17c404e3665ec645d1c3e9e68
SHA512

e074bcf37ad58f41cf114884b6e08edc0e07fb37fd62009aae2194bc9d8477af373b81bfe6459a293931da61a8446ba3c0f1904cfcce1cc3e6dae89004e7dd92

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4224 3124 WerFault.exe cbe17c61a228c74d2df1e36ad7232ac8.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cbe17c61a228c74d2df1e36ad7232ac8.exe

pid process

3124 cbe17c61a228c74d2df1e36ad7232ac8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cbe17c61a228c74d2df1e36ad7232ac8.exe

description pid process

Token: SeDebugPrivilege 3124 cbe17c61a228c74d2df1e36ad7232ac8.exe

pid	pid_target	process	target process
4224	3124	WerFault.exe	cbe17c61a228c74d2df1e36ad7232ac8.exe

pid	process
3124	cbe17c61a228c74d2df1e36ad7232ac8.exe

description	pid	process
Token: SeDebugPrivilege	3124	cbe17c61a228c74d2df1e36ad7232ac8.exe

C:\Users\Admin\AppData\Local\Temp\cbe17c61a228c74d2df1e36ad7232ac8.exe
"C:\Users\Admin\AppData\Local\Temp\cbe17c61a228c74d2df1e36ad7232ac8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1140
2⤵
- Program crash
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3124 -ip 3124
1⤵
PID:5052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3124-130-0x00000000052A0000-0x0000000005844000-memory.dmp

Filesize
5.6MB

Download
memory/3124-131-0x0000000000DE2000-0x0000000000E0E000-memory.dmp

Filesize
176KB

Download
memory/3124-132-0x0000000002870000-0x00000000028A9000-memory.dmp

Filesize
228KB

Download
memory/3124-133-0x0000000000400000-0x0000000000A93000-memory.dmp

Filesize
6.6MB

Download
memory/3124-134-0x0000000005850000-0x0000000005E68000-memory.dmp

Filesize
6.1MB

Download
memory/3124-135-0x0000000005260000-0x0000000005272000-memory.dmp

Filesize
72KB

Download
memory/3124-136-0x0000000005E70000-0x0000000005F7A000-memory.dmp

Filesize
1.0MB

Download
memory/3124-137-0x0000000005FA0000-0x0000000005FDC000-memory.dmp

Filesize
240KB

Download
memory/3124-138-0x00000000062A0000-0x0000000006316000-memory.dmp

Filesize
472KB

Download
memory/3124-139-0x0000000006390000-0x0000000006422000-memory.dmp

Filesize
584KB

Download
memory/3124-140-0x0000000006530000-0x000000000654E000-memory.dmp

Filesize
120KB

Download
memory/3124-141-0x00000000065C0000-0x0000000006626000-memory.dmp

Filesize
408KB

Download
memory/3124-142-0x00000000078B0000-0x0000000007A72000-memory.dmp

Filesize
1.8MB

Download
memory/3124-143-0x0000000007A90000-0x0000000007FBC000-memory.dmp

Filesize
5.2MB

Download
memory/3124-144-0x0000000000DE2000-0x0000000000E0E000-memory.dmp

Filesize
176KB

Download
memory/3124-145-0x0000000006D00000-0x0000000006D50000-memory.dmp

Filesize
320KB

Download
memory/3124-146-0x0000000000DE2000-0x0000000000E0E000-memory.dmp

Filesize
176KB

Download
memory/3124-147-0x0000000000400000-0x0000000000A93000-memory.dmp

Filesize
6.6MB

Download

Analysis

Sharing