f33a6585faa522f1f03b4bacbd77cb5adc0d1ad54223b89dc8f6ebb05edfe000

Resubmissions

29-09-2022 16:54

26-09-2022 08:47

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-09-2022 16:54

Target

bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe
Size

184KB
MD5

4c22c20fd816c11a3670100a40ac9dc0
SHA1

19b937654065f5ee8baee95026f6ea7466ee2322
SHA256

f33a6585faa522f1f03b4bacbd77cb5adc0d1ad54223b89dc8f6ebb05edfe000
SHA512

fe7e2da40c992cd913c165bcc06815ecf8ce4421bcb0edaa81c41d91707e603b1954c9d53af841011e6549eed0bde757f906d099174b40b9249b0291e45d6bc9
SSDEEP

3072:Y8S6mF4saj1M0WstmJDd/osAytLOHDxqTqYMia0ZNfo+CEkuRux4Kc0VrOR952St:Yg1saj6AfygD6lMitZSUux4N0VrOzuqH

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

336 2032 WerFault.exe bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe

pid	pid_target	process	target process
336	2032	WerFault.exe	bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe

description	pid	process	target process
PID 2032 wrote to memory of 336	2032	bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe	WerFault.exe
PID 2032 wrote to memory of 336	2032	bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe	WerFault.exe
PID 2032 wrote to memory of 336	2032	bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe	WerFault.exe
PID 2032 wrote to memory of 336	2032	bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 472
2⤵
- Program crash
PID:336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/336-55-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download