719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25

Analysis

max time kernel
61s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe
Size

4.7MB
MD5

d257f14151fb900f2cf3227b115a930e
SHA1

c0638125ce1f301acc47b47f26fcf76568ee2db6
SHA256

719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25
SHA512

e080c6c9a6d75509275dcd8c2508c3f9bef67276999915e5f1c682ca670eb57ee048c1ba862212ad7c6f21144735992c49d7b4e46213e58f11e528859901931d
SSDEEP

98304:62hBpKO+6PbFmS3VjVEOeTtJaAbLECnrZXJT7:6gbFmS3VjVEOeTtJHbdnrz7

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4688	2280	WerFault.exe	80
540	2280	WerFault.exe	80
4084	2280	WerFault.exe	80
2016	2280	WerFault.exe	80
4656	2280	WerFault.exe	80
4604	2280	WerFault.exe	80
4256	2280	WerFault.exe	80
3756	2280	WerFault.exe	80
4324	2280	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4704	wmic.exe
Token: SeSecurityPrivilege	4704	wmic.exe
Token: SeTakeOwnershipPrivilege	4704	wmic.exe
Token: SeLoadDriverPrivilege	4704	wmic.exe
Token: SeSystemProfilePrivilege	4704	wmic.exe
Token: SeSystemtimePrivilege	4704	wmic.exe
Token: SeProfSingleProcessPrivilege	4704	wmic.exe
Token: SeIncBasePriorityPrivilege	4704	wmic.exe
Token: SeCreatePagefilePrivilege	4704	wmic.exe
Token: SeBackupPrivilege	4704	wmic.exe
Token: SeRestorePrivilege	4704	wmic.exe
Token: SeShutdownPrivilege	4704	wmic.exe
Token: SeDebugPrivilege	4704	wmic.exe
Token: SeSystemEnvironmentPrivilege	4704	wmic.exe
Token: SeRemoteShutdownPrivilege	4704	wmic.exe
Token: SeUndockPrivilege	4704	wmic.exe
Token: SeManageVolumePrivilege	4704	wmic.exe
Token: 33	4704	wmic.exe
Token: 34	4704	wmic.exe
Token: 35	4704	wmic.exe
Token: 36	4704	wmic.exe
Token: SeIncreaseQuotaPrivilege	4704	wmic.exe
Token: SeSecurityPrivilege	4704	wmic.exe
Token: SeTakeOwnershipPrivilege	4704	wmic.exe
Token: SeLoadDriverPrivilege	4704	wmic.exe
Token: SeSystemProfilePrivilege	4704	wmic.exe
Token: SeSystemtimePrivilege	4704	wmic.exe
Token: SeProfSingleProcessPrivilege	4704	wmic.exe
Token: SeIncBasePriorityPrivilege	4704	wmic.exe
Token: SeCreatePagefilePrivilege	4704	wmic.exe
Token: SeBackupPrivilege	4704	wmic.exe
Token: SeRestorePrivilege	4704	wmic.exe
Token: SeShutdownPrivilege	4704	wmic.exe
Token: SeDebugPrivilege	4704	wmic.exe
Token: SeSystemEnvironmentPrivilege	4704	wmic.exe
Token: SeRemoteShutdownPrivilege	4704	wmic.exe
Token: SeUndockPrivilege	4704	wmic.exe
Token: SeManageVolumePrivilege	4704	wmic.exe
Token: 33	4704	wmic.exe
Token: 34	4704	wmic.exe
Token: 35	4704	wmic.exe
Token: 36	4704	wmic.exe
Token: SeIncreaseQuotaPrivilege	4924	WMIC.exe
Token: SeSecurityPrivilege	4924	WMIC.exe
Token: SeTakeOwnershipPrivilege	4924	WMIC.exe
Token: SeLoadDriverPrivilege	4924	WMIC.exe
Token: SeSystemProfilePrivilege	4924	WMIC.exe
Token: SeSystemtimePrivilege	4924	WMIC.exe
Token: SeProfSingleProcessPrivilege	4924	WMIC.exe
Token: SeIncBasePriorityPrivilege	4924	WMIC.exe
Token: SeCreatePagefilePrivilege	4924	WMIC.exe
Token: SeBackupPrivilege	4924	WMIC.exe
Token: SeRestorePrivilege	4924	WMIC.exe
Token: SeShutdownPrivilege	4924	WMIC.exe
Token: SeDebugPrivilege	4924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4924	WMIC.exe
Token: SeRemoteShutdownPrivilege	4924	WMIC.exe
Token: SeUndockPrivilege	4924	WMIC.exe
Token: SeManageVolumePrivilege	4924	WMIC.exe
Token: 33	4924	WMIC.exe
Token: 34	4924	WMIC.exe
Token: 35	4924	WMIC.exe
Token: 36	4924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4924	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4704	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	101
PID 2280 wrote to memory of 4704	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	101
PID 2280 wrote to memory of 4704	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	101
PID 2280 wrote to memory of 808	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	107
PID 2280 wrote to memory of 808	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	107
PID 2280 wrote to memory of 808	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	107
PID 808 wrote to memory of 4924	808	cmd.exe	109
PID 808 wrote to memory of 4924	808	cmd.exe	109
PID 808 wrote to memory of 4924	808	cmd.exe	109
PID 2280 wrote to memory of 5104	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	110
PID 2280 wrote to memory of 5104	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	110
PID 2280 wrote to memory of 5104	2280	719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe	110
PID 5104 wrote to memory of 2320	5104	cmd.exe	112
PID 5104 wrote to memory of 2320	5104	cmd.exe	112
PID 5104 wrote to memory of 2320	5104	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe
"C:\Users\Admin\AppData\Local\Temp\719d1a75d25fa1cb99f8842f6444ceb231c0405f239afdea5e5f0e77457a4b25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 548
  2⤵
  - Program crash
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 568
  2⤵
  - Program crash
  PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 568
  2⤵
  - Program crash
  PID:4084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 644
  2⤵
  - Program crash
  PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 760
  2⤵
  - Program crash
  PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 844
  2⤵
  - Program crash
  PID:4604
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1296
  2⤵
  - Program crash
  PID:4256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1332
  2⤵
  - Program crash
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 140
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2280 -ip 2280
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2280 -ip 2280
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2280 -ip 2280
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2280 -ip 2280
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2280 -ip 2280
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2280 -ip 2280
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2280 -ip 2280
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-135-0x0000000000000000-mapping.dmp

Download
memory/2280-132-0x00000000030E0000-0x0000000003527000-memory.dmp

Filesize
4.3MB

Download
memory/2280-133-0x0000000000400000-0x00000000008BC000-memory.dmp

Filesize
4.7MB

Download
memory/2280-139-0x0000000000400000-0x00000000008BC000-memory.dmp

Filesize
4.7MB

Download
memory/2320-138-0x0000000000000000-mapping.dmp

Download
memory/4704-134-0x0000000000000000-mapping.dmp

Download
memory/4924-136-0x0000000000000000-mapping.dmp

Download
memory/5104-137-0x0000000000000000-mapping.dmp

Download