Analysis
-
max time kernel
78s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 08:26
Static task
static1
Behavioral task
behavioral1
Sample
1050dbf8cc5dd55bac9f31e0a3e98205.exe
Resource
win7-20220718-en
General
-
Target
1050dbf8cc5dd55bac9f31e0a3e98205.exe
-
Size
281KB
-
MD5
1050dbf8cc5dd55bac9f31e0a3e98205
-
SHA1
cfeebbbc3fff7c87f33a70e46f282b7dbc338ade
-
SHA256
9ab724ffa4cb578db0e3dc72cf1d6f2f63fbce657da0792f0b86269c47b84c2f
-
SHA512
94a660920df8b3ea47691c662d29faa70d3719f34eab81a5c77ea5e99832e652e86fd63cad6eed1f6845516de6c497ec89218059c175992f83c7c2c4afa451fe
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3824 4244 WerFault.exe 1050dbf8cc5dd55bac9f31e0a3e98205.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1050dbf8cc5dd55bac9f31e0a3e98205.exepid process 4244 1050dbf8cc5dd55bac9f31e0a3e98205.exe 4244 1050dbf8cc5dd55bac9f31e0a3e98205.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1050dbf8cc5dd55bac9f31e0a3e98205.exedescription pid process Token: SeDebugPrivilege 4244 1050dbf8cc5dd55bac9f31e0a3e98205.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1050dbf8cc5dd55bac9f31e0a3e98205.exe"C:\Users\Admin\AppData\Local\Temp\1050dbf8cc5dd55bac9f31e0a3e98205.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 18602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4244 -ip 42441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4244-130-0x0000000004EA0000-0x0000000005444000-memory.dmpFilesize
5.6MB
-
memory/4244-131-0x00000000007CE000-0x00000000007F8000-memory.dmpFilesize
168KB
-
memory/4244-132-0x0000000002250000-0x0000000002288000-memory.dmpFilesize
224KB
-
memory/4244-133-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/4244-134-0x0000000005450000-0x0000000005A68000-memory.dmpFilesize
6.1MB
-
memory/4244-135-0x0000000004E00000-0x0000000004E12000-memory.dmpFilesize
72KB
-
memory/4244-136-0x0000000005A70000-0x0000000005B7A000-memory.dmpFilesize
1.0MB
-
memory/4244-137-0x0000000004E40000-0x0000000004E7C000-memory.dmpFilesize
240KB
-
memory/4244-138-0x0000000006960000-0x00000000069C6000-memory.dmpFilesize
408KB
-
memory/4244-139-0x0000000006DE0000-0x0000000006E56000-memory.dmpFilesize
472KB
-
memory/4244-140-0x0000000006E80000-0x0000000006F12000-memory.dmpFilesize
584KB
-
memory/4244-141-0x0000000006FB0000-0x0000000006FCE000-memory.dmpFilesize
120KB
-
memory/4244-142-0x00000000073A0000-0x0000000007562000-memory.dmpFilesize
1.8MB
-
memory/4244-143-0x0000000007580000-0x0000000007AAC000-memory.dmpFilesize
5.2MB
-
memory/4244-144-0x0000000007E30000-0x0000000007E80000-memory.dmpFilesize
320KB
-
memory/4244-145-0x00000000007CE000-0x00000000007F8000-memory.dmpFilesize
168KB
-
memory/4244-146-0x00000000007CE000-0x00000000007F8000-memory.dmpFilesize
168KB
-
memory/4244-147-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB