Analysis
- max time kernel
81s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
27/08/2022, 00:36
General
- Target f2ad29e4ebad84187771edddc8509276.exe
- Size 419KB
- Sample220827-axyamabfek
- SHA256 084e32c21629bd6aeef802a1cad1dcf3efb64cc839c5cdaad3265347124abf2b
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ad29e4ebad84187771edddc8509276.exe"C:\Users\Admin\AppData\Local\Temp\f2ad29e4ebad84187771edddc8509276.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4616 -ip 46161⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4616-132-0x000000000095D000-0x0000000000987000-memory.dmp
memory/4616-133-0x00000000024B0000-0x00000000024E7000-memory.dmp
memory/4616-134-0x0000000005060000-0x0000000005604000-memory.dmp
memory/4616-135-0x0000000000400000-0x000000000086B000-memory.dmp
memory/4616-136-0x0000000005610000-0x0000000005C28000-memory.dmp
memory/4616-137-0x0000000002B90000-0x0000000002BA2000-memory.dmp
memory/4616-138-0x0000000002BB0000-0x0000000002CBA000-memory.dmp
memory/4616-139-0x0000000005D30000-0x0000000005D6C000-memory.dmp
memory/4616-140-0x0000000006A40000-0x0000000006AD2000-memory.dmp
memory/4616-141-0x0000000006AF0000-0x0000000006B56000-memory.dmp
memory/4616-142-0x0000000006E40000-0x0000000006EB6000-memory.dmp
memory/4616-143-0x0000000006EF0000-0x0000000006F0E000-memory.dmp
memory/4616-144-0x0000000006FC0000-0x0000000007182000-memory.dmp
memory/4616-145-0x00000000071A0000-0x00000000076CC000-memory.dmp
memory/4616-146-0x0000000007D80000-0x0000000007DD0000-memory.dmp
memory/4616-147-0x000000000095D000-0x0000000000987000-memory.dmp
memory/4616-148-0x00000000024B0000-0x00000000024E7000-memory.dmp
memory/4616-149-0x0000000000400000-0x000000000086B000-memory.dmp