Analysis
- max time kernel
67s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220718-en - resource tags
- submitted
20/07/2022, 12:31
General
- Target e7b65dfce6a10832c757f552ab7d79f0.exe
- Size 396KB
- Sample220720-pp216sfca5
- SHA256 14f0d0932bbf01eddc2a59bb7fe57b775eba49b5cbb8deff2602e25a232f6c8c
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b65dfce6a10832c757f552ab7d79f0.exe"C:\Users\Admin\AppData\Local\Temp\e7b65dfce6a10832c757f552ab7d79f0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 24402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1164 -ip 11641⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1164-130-0x0000000004B60000-0x0000000005104000-memory.dmp
memory/1164-131-0x000000000074D000-0x0000000000778000-memory.dmp
memory/1164-132-0x00000000021D0000-0x0000000002208000-memory.dmp
memory/1164-133-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1164-134-0x0000000005150000-0x0000000005768000-memory.dmp
memory/1164-135-0x0000000005800000-0x0000000005812000-memory.dmp
memory/1164-136-0x0000000005820000-0x000000000592A000-memory.dmp
memory/1164-137-0x0000000005950000-0x000000000598C000-memory.dmp
memory/1164-138-0x00000000068C0000-0x0000000006952000-memory.dmp
memory/1164-139-0x0000000006970000-0x00000000069D6000-memory.dmp
memory/1164-140-0x0000000006CC0000-0x0000000006D36000-memory.dmp
memory/1164-141-0x0000000006DE0000-0x0000000006DFE000-memory.dmp
memory/1164-142-0x0000000006F60000-0x0000000006FB0000-memory.dmp
memory/1164-143-0x0000000007BA0000-0x0000000007D62000-memory.dmp
memory/1164-144-0x0000000007D90000-0x00000000082BC000-memory.dmp
memory/1164-145-0x000000000074D000-0x0000000000778000-memory.dmp
memory/1164-146-0x000000000074D000-0x0000000000778000-memory.dmp
memory/1164-147-0x0000000000400000-0x000000000046E000-memory.dmp