ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80

Analysis

max time kernel
140s
max time network
143s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
07-10-2022 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe
Size

4.8MB
MD5

06cd0e4fb834636463de1fd8f8490839
SHA1

4a32d37e51f1ac28efd84f2b407c064143e63a4a
SHA256

ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80
SHA512

afc9761d598ada1f358b4d31584e904824462d9d5e800400258cfb88e556f59a7245c7f628c8b63a716a663fbf8426542035d94900fbd95c06e318cfee0716db
SSDEEP

98304:F6aOpKO+6PbFmS3VjVEOeTtJaAbLECnrZXJT7W:F2bFmS3VjVEOeTtJHbdnrz7

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4212	4820	WerFault.exe	66
3444	4820	WerFault.exe	66
3368	4820	WerFault.exe	66
3636	4820	WerFault.exe	66
2208	4820	WerFault.exe	66
2952	4820	WerFault.exe	66
4440	4820	WerFault.exe	66
3172	4820	WerFault.exe	66
1100	4820	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4092	wmic.exe
Token: SeSecurityPrivilege	4092	wmic.exe
Token: SeTakeOwnershipPrivilege	4092	wmic.exe
Token: SeLoadDriverPrivilege	4092	wmic.exe
Token: SeSystemProfilePrivilege	4092	wmic.exe
Token: SeSystemtimePrivilege	4092	wmic.exe
Token: SeProfSingleProcessPrivilege	4092	wmic.exe
Token: SeIncBasePriorityPrivilege	4092	wmic.exe
Token: SeCreatePagefilePrivilege	4092	wmic.exe
Token: SeBackupPrivilege	4092	wmic.exe
Token: SeRestorePrivilege	4092	wmic.exe
Token: SeShutdownPrivilege	4092	wmic.exe
Token: SeDebugPrivilege	4092	wmic.exe
Token: SeSystemEnvironmentPrivilege	4092	wmic.exe
Token: SeRemoteShutdownPrivilege	4092	wmic.exe
Token: SeUndockPrivilege	4092	wmic.exe
Token: SeManageVolumePrivilege	4092	wmic.exe
Token: 33	4092	wmic.exe
Token: 34	4092	wmic.exe
Token: 35	4092	wmic.exe
Token: 36	4092	wmic.exe
Token: SeIncreaseQuotaPrivilege	4092	wmic.exe
Token: SeSecurityPrivilege	4092	wmic.exe
Token: SeTakeOwnershipPrivilege	4092	wmic.exe
Token: SeLoadDriverPrivilege	4092	wmic.exe
Token: SeSystemProfilePrivilege	4092	wmic.exe
Token: SeSystemtimePrivilege	4092	wmic.exe
Token: SeProfSingleProcessPrivilege	4092	wmic.exe
Token: SeIncBasePriorityPrivilege	4092	wmic.exe
Token: SeCreatePagefilePrivilege	4092	wmic.exe
Token: SeBackupPrivilege	4092	wmic.exe
Token: SeRestorePrivilege	4092	wmic.exe
Token: SeShutdownPrivilege	4092	wmic.exe
Token: SeDebugPrivilege	4092	wmic.exe
Token: SeSystemEnvironmentPrivilege	4092	wmic.exe
Token: SeRemoteShutdownPrivilege	4092	wmic.exe
Token: SeUndockPrivilege	4092	wmic.exe
Token: SeManageVolumePrivilege	4092	wmic.exe
Token: 33	4092	wmic.exe
Token: 34	4092	wmic.exe
Token: 35	4092	wmic.exe
Token: 36	4092	wmic.exe
Token: SeIncreaseQuotaPrivilege	3188	WMIC.exe
Token: SeSecurityPrivilege	3188	WMIC.exe
Token: SeTakeOwnershipPrivilege	3188	WMIC.exe
Token: SeLoadDriverPrivilege	3188	WMIC.exe
Token: SeSystemProfilePrivilege	3188	WMIC.exe
Token: SeSystemtimePrivilege	3188	WMIC.exe
Token: SeProfSingleProcessPrivilege	3188	WMIC.exe
Token: SeIncBasePriorityPrivilege	3188	WMIC.exe
Token: SeCreatePagefilePrivilege	3188	WMIC.exe
Token: SeBackupPrivilege	3188	WMIC.exe
Token: SeRestorePrivilege	3188	WMIC.exe
Token: SeShutdownPrivilege	3188	WMIC.exe
Token: SeDebugPrivilege	3188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3188	WMIC.exe
Token: SeRemoteShutdownPrivilege	3188	WMIC.exe
Token: SeUndockPrivilege	3188	WMIC.exe
Token: SeManageVolumePrivilege	3188	WMIC.exe
Token: 33	3188	WMIC.exe
Token: 34	3188	WMIC.exe
Token: 35	3188	WMIC.exe
Token: 36	3188	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3188	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4092	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	75
PID 4820 wrote to memory of 4092	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	75
PID 4820 wrote to memory of 4092	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	75
PID 4820 wrote to memory of 4708	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	79
PID 4820 wrote to memory of 4708	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	79
PID 4820 wrote to memory of 4708	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	79
PID 4708 wrote to memory of 3188	4708	cmd.exe	81
PID 4708 wrote to memory of 3188	4708	cmd.exe	81
PID 4708 wrote to memory of 3188	4708	cmd.exe	81
PID 4820 wrote to memory of 1672	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	82
PID 4820 wrote to memory of 1672	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	82
PID 4820 wrote to memory of 1672	4820	ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe	82
PID 1672 wrote to memory of 1912	1672	cmd.exe	84
PID 1672 wrote to memory of 1912	1672	cmd.exe	84
PID 1672 wrote to memory of 1912	1672	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe
"C:\Users\Admin\AppData\Local\Temp\ee9e5daae03c9186ab596fdbc0afe629a73c056aba35c08a4da3b19353e93a80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 544
  2⤵
  - Program crash
  PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 592
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 504
  2⤵
  - Program crash
  PID:3368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 644
  2⤵
  - Program crash
  PID:3636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 696
  2⤵
  - Program crash
  PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 684
  2⤵
  - Program crash
  PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1008
  2⤵
  - Program crash
  PID:4440
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1332
  2⤵
  - Program crash
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 316
  2⤵
  - Program crash
  PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-308-0x0000000000000000-mapping.dmp

Download
memory/1912-314-0x0000000000000000-mapping.dmp

Download
memory/3188-241-0x0000000000000000-mapping.dmp

Download
memory/4092-175-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-177-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-180-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-182-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-181-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-179-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-178-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-168-0x0000000000000000-mapping.dmp

Download
memory/4092-176-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-169-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-174-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-173-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-172-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-171-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4092-170-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-235-0x0000000000000000-mapping.dmp

Download
memory/4820-134-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-161-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-137-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-139-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-140-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-138-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-141-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-142-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-143-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-144-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-145-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-146-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-147-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-148-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-149-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-150-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-151-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-152-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-153-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-154-0x0000000003090000-0x00000000034D7000-memory.dmp

Filesize
4.3MB

Download
memory/4820-155-0x0000000000400000-0x00000000008D0000-memory.dmp

Filesize
4.8MB

Download
memory/4820-156-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-157-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-158-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-159-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-160-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-162-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-136-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-163-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-165-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-164-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-166-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-167-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-135-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-116-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-133-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-132-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-131-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-130-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-129-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-128-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-127-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-126-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-125-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-124-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-122-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-123-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-121-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-120-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-119-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-118-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-117-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-382-0x0000000000400000-0x00000000008D0000-memory.dmp

Filesize
4.8MB

Download