Analysis
- max time kernel
91s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
29/09/2022, 09:39
General
- Target 00819499e555a62f4e0b0790dd5c5565.exe
- Size 420KB
- Sample220929-lml1dsach3
- SHA256 c96f914dd24ba81952c578e08d3d3e84bfe2c5ed63dc563ca0befcf672528ae6
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00819499e555a62f4e0b0790dd5c5565.exe"C:\Users\Admin\AppData\Local\Temp\00819499e555a62f4e0b0790dd5c5565.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 8802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2448 -ip 24481⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2448-132-0x0000000000719000-0x000000000074A000-memory.dmp
memory/2448-133-0x00000000006C0000-0x00000000006FE000-memory.dmp
memory/2448-134-0x0000000000400000-0x000000000046E000-memory.dmp
memory/2448-135-0x0000000004C90000-0x0000000005234000-memory.dmp
memory/2448-136-0x0000000004B80000-0x0000000004C12000-memory.dmp
memory/2448-137-0x00000000054B0000-0x0000000005AC8000-memory.dmp
memory/2448-138-0x00000000052D0000-0x00000000053DA000-memory.dmp
memory/2448-139-0x0000000005400000-0x0000000005412000-memory.dmp
memory/2448-140-0x0000000005420000-0x000000000545C000-memory.dmp
memory/2448-141-0x0000000005D60000-0x0000000005DC6000-memory.dmp
memory/2448-142-0x0000000006670000-0x0000000006832000-memory.dmp
memory/2448-144-0x0000000000719000-0x000000000074A000-memory.dmp
memory/2448-143-0x0000000006850000-0x0000000006D7C000-memory.dmp
memory/2448-145-0x0000000008E60000-0x0000000008ED6000-memory.dmp
memory/2448-146-0x0000000008EE0000-0x0000000008F30000-memory.dmp
memory/2448-147-0x0000000000719000-0x000000000074A000-memory.dmp
memory/2448-148-0x0000000000400000-0x000000000046E000-memory.dmp