Analysis
-
max time kernel
87s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2022, 04:17
Static task
static1
General
-
Target
91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe
-
Size
352KB
-
MD5
57ef994ddb8121f439eb499304901944
-
SHA1
393ae599309cef16d16173e0b10bb7a6562e85d1
-
SHA256
91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19
-
SHA512
2b252ca53b93ebed4f6b947cf58761a1b3c6a9aa7ebf174d14da8b276395e1e5c0da5cb042cf9f8d2f6f21759506c7dd8a1f505352e34de06e14e362679d5143
-
SSDEEP
6144:kAjyqjNAvdr312XheadRw5NZ85/l2Aj8Dc6ItY+pp/W8PfFsvwuqz:H5juvdr312XBdRwSwAj8wBtY8p/V6vwp
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4860 808 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 808 91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe 808 91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 808 91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe"C:\Users\Admin\AppData\Local\Temp\91f2cde28e2de27ef0fc1a971c9cae90f82c943b60f5700acb49cbe4df23dd19.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 18722⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 808 -ip 8081⤵PID:560