Analysis
- max time kernel
51s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
- submitted
25/07/2022, 08:43
General
- Target 24bc079425ffd9aaeccf5118816a48d2.exe
- Size 307KB
- Sample220725-kmk8esbfak
- SHA256 32180e0ffd8f7fa01267821af5d93caebaf13936ae4a2542d2ea627256ce482f
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24bc079425ffd9aaeccf5118816a48d2.exe"C:\Users\Admin\AppData\Local\Temp\24bc079425ffd9aaeccf5118816a48d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 21802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3380 -ip 33801⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3380-135-0x0000000000752000-0x000000000077C000-memory.dmp
memory/3380-136-0x0000000000A10000-0x0000000000A48000-memory.dmp
memory/3380-137-0x0000000000400000-0x0000000000666000-memory.dmp
memory/3380-138-0x0000000004E20000-0x00000000053C4000-memory.dmp
memory/3380-139-0x00000000053D0000-0x00000000059E8000-memory.dmp
memory/3380-140-0x0000000005A70000-0x0000000005A82000-memory.dmp
memory/3380-141-0x0000000005A90000-0x0000000005B9A000-memory.dmp
memory/3380-142-0x0000000005BC0000-0x0000000005BFC000-memory.dmp
memory/3380-143-0x0000000006B30000-0x0000000006B96000-memory.dmp
memory/3380-144-0x0000000006E70000-0x0000000006EE6000-memory.dmp
memory/3380-145-0x0000000006F10000-0x0000000006FA2000-memory.dmp
memory/3380-146-0x0000000007040000-0x000000000705E000-memory.dmp
memory/3380-147-0x00000000074E0000-0x0000000007530000-memory.dmp
memory/3380-148-0x00000000077F0000-0x00000000079B2000-memory.dmp
memory/3380-149-0x00000000079C0000-0x0000000007EEC000-memory.dmp
memory/3380-150-0x0000000000400000-0x0000000000666000-memory.dmp