Analysis
- max time kernel
152s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
- submitted
04/08/2022, 01:01
General
- Target 4ae642b458eefdcfff7d6fa2ffc71452.exe
- Size 195KB
- Sample220804-bc8fjaaccn
- SHA256 823cc32c034672805f39c8cffbadbdd8614bb3886dbcd4cb8c8f68bd5e49d1f4
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae642b458eefdcfff7d6fa2ffc71452.exe"C:\Users\Admin\AppData\Local\Temp\4ae642b458eefdcfff7d6fa2ffc71452.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\22A6.exeC:\Users\Admin\AppData\Local\Temp\22A6.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 15322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3764 -ip 37641⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
22A6.exe
22A6.exe
memory/3172-136-0x00000000007C0000-0x00000000007C9000-memory.dmp
memory/3172-137-0x0000000000400000-0x000000000064B000-memory.dmp
memory/3172-138-0x0000000000400000-0x000000000064B000-memory.dmp
memory/3172-135-0x000000000069E000-0x00000000006AE000-memory.dmp
memory/3764-147-0x0000000005820000-0x0000000005832000-memory.dmp
memory/3764-150-0x00000000068D0000-0x0000000006962000-memory.dmp
memory/3764-143-0x00000000020A0000-0x00000000020D8000-memory.dmp
memory/3764-144-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3764-145-0x0000000004C50000-0x00000000051F4000-memory.dmp
memory/3764-146-0x0000000005200000-0x0000000005818000-memory.dmp
memory/3764-148-0x0000000005840000-0x000000000594A000-memory.dmp
memory/3764-149-0x0000000005960000-0x000000000599C000-memory.dmp
memory/3764-142-0x00000000004B9000-0x00000000004E4000-memory.dmp
memory/3764-151-0x0000000006980000-0x00000000069F6000-memory.dmp
memory/3764-152-0x0000000006BD0000-0x0000000006BEE000-memory.dmp
memory/3764-153-0x0000000006C40000-0x0000000006CA6000-memory.dmp
memory/3764-154-0x0000000007070000-0x00000000070C0000-memory.dmp
memory/3764-155-0x0000000007170000-0x0000000007332000-memory.dmp
memory/3764-156-0x00000000004B9000-0x00000000004E4000-memory.dmp
memory/3764-157-0x0000000007340000-0x000000000786C000-memory.dmp
memory/3764-158-0x00000000004B9000-0x00000000004E4000-memory.dmp
memory/3764-159-0x0000000000400000-0x000000000047D000-memory.dmp