b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727

Analysis

max time kernel
142s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2022, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe
Size

5.9MB
MD5

c99f3e810ece419b83ef4721655c2596
SHA1

a07b610588ad9fe0e8744a6468bd92bf0f00e50b
SHA256

b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727
SHA512

4914415aa3138e4240f01c333e3a84f61d151d57feb17abac0cbd448b74714d44ee49cdd313c26f15208dc73b6916a401662f2f36c0148213ebf99d6923ff134
SSDEEP

49152:CC10bhkuFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKga:CC10bhMSjL+EnHOMz5ysZA5+bf6c

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 10 IoCs

pid	pid_target	Process	procid_target
1696	4944	WerFault.exe	65
4560	4944	WerFault.exe	65
2000	4944	WerFault.exe	65
4548	4944	WerFault.exe	65
4632	4944	WerFault.exe	65
4008	4944	WerFault.exe	65
4680	4944	WerFault.exe	65
3816	4944	WerFault.exe	65
4296	4944	WerFault.exe	65
2360	4944	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4536	wmic.exe
Token: SeSecurityPrivilege	4536	wmic.exe
Token: SeTakeOwnershipPrivilege	4536	wmic.exe
Token: SeLoadDriverPrivilege	4536	wmic.exe
Token: SeSystemProfilePrivilege	4536	wmic.exe
Token: SeSystemtimePrivilege	4536	wmic.exe
Token: SeProfSingleProcessPrivilege	4536	wmic.exe
Token: SeIncBasePriorityPrivilege	4536	wmic.exe
Token: SeCreatePagefilePrivilege	4536	wmic.exe
Token: SeBackupPrivilege	4536	wmic.exe
Token: SeRestorePrivilege	4536	wmic.exe
Token: SeShutdownPrivilege	4536	wmic.exe
Token: SeDebugPrivilege	4536	wmic.exe
Token: SeSystemEnvironmentPrivilege	4536	wmic.exe
Token: SeRemoteShutdownPrivilege	4536	wmic.exe
Token: SeUndockPrivilege	4536	wmic.exe
Token: SeManageVolumePrivilege	4536	wmic.exe
Token: 33	4536	wmic.exe
Token: 34	4536	wmic.exe
Token: 35	4536	wmic.exe
Token: 36	4536	wmic.exe
Token: SeIncreaseQuotaPrivilege	4536	wmic.exe
Token: SeSecurityPrivilege	4536	wmic.exe
Token: SeTakeOwnershipPrivilege	4536	wmic.exe
Token: SeLoadDriverPrivilege	4536	wmic.exe
Token: SeSystemProfilePrivilege	4536	wmic.exe
Token: SeSystemtimePrivilege	4536	wmic.exe
Token: SeProfSingleProcessPrivilege	4536	wmic.exe
Token: SeIncBasePriorityPrivilege	4536	wmic.exe
Token: SeCreatePagefilePrivilege	4536	wmic.exe
Token: SeBackupPrivilege	4536	wmic.exe
Token: SeRestorePrivilege	4536	wmic.exe
Token: SeShutdownPrivilege	4536	wmic.exe
Token: SeDebugPrivilege	4536	wmic.exe
Token: SeSystemEnvironmentPrivilege	4536	wmic.exe
Token: SeRemoteShutdownPrivilege	4536	wmic.exe
Token: SeUndockPrivilege	4536	wmic.exe
Token: SeManageVolumePrivilege	4536	wmic.exe
Token: 33	4536	wmic.exe
Token: 34	4536	wmic.exe
Token: 35	4536	wmic.exe
Token: 36	4536	wmic.exe
Token: SeIncreaseQuotaPrivilege	4676	WMIC.exe
Token: SeSecurityPrivilege	4676	WMIC.exe
Token: SeTakeOwnershipPrivilege	4676	WMIC.exe
Token: SeLoadDriverPrivilege	4676	WMIC.exe
Token: SeSystemProfilePrivilege	4676	WMIC.exe
Token: SeSystemtimePrivilege	4676	WMIC.exe
Token: SeProfSingleProcessPrivilege	4676	WMIC.exe
Token: SeIncBasePriorityPrivilege	4676	WMIC.exe
Token: SeCreatePagefilePrivilege	4676	WMIC.exe
Token: SeBackupPrivilege	4676	WMIC.exe
Token: SeRestorePrivilege	4676	WMIC.exe
Token: SeShutdownPrivilege	4676	WMIC.exe
Token: SeDebugPrivilege	4676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4676	WMIC.exe
Token: SeRemoteShutdownPrivilege	4676	WMIC.exe
Token: SeUndockPrivilege	4676	WMIC.exe
Token: SeManageVolumePrivilege	4676	WMIC.exe
Token: 33	4676	WMIC.exe
Token: 34	4676	WMIC.exe
Token: 35	4676	WMIC.exe
Token: 36	4676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4676	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4536	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	73
PID 4944 wrote to memory of 4536	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	73
PID 4944 wrote to memory of 4536	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	73
PID 4944 wrote to memory of 4508	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	79
PID 4944 wrote to memory of 4508	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	79
PID 4944 wrote to memory of 4508	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	79
PID 4508 wrote to memory of 4676	4508	cmd.exe	81
PID 4508 wrote to memory of 4676	4508	cmd.exe	81
PID 4508 wrote to memory of 4676	4508	cmd.exe	81
PID 4944 wrote to memory of 4732	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	82
PID 4944 wrote to memory of 4732	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	82
PID 4944 wrote to memory of 4732	4944	b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe	82
PID 4732 wrote to memory of 2672	4732	cmd.exe	84
PID 4732 wrote to memory of 2672	4732	cmd.exe	84
PID 4732 wrote to memory of 2672	4732	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe
"C:\Users\Admin\AppData\Local\Temp\b90c2bbcd5b20bc2759384709ee5ac8613938120b655b369a8e370f44e2df727.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 544
  2⤵
  - Program crash
  PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 516
  2⤵
  - Program crash
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 588
  2⤵
  - Program crash
  PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 640
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 748
  2⤵
  - Program crash
  PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 880
  2⤵
  - Program crash
  PID:4008
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1328
  2⤵
  - Program crash
  PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1344
  2⤵
  - Program crash
  PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1268
  2⤵
  - Program crash
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 268
  2⤵
  - Program crash
  PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4536-183-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-180-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-173-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-186-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-185-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-184-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-182-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-181-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-174-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-179-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-178-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-177-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-176-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4536-175-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-139-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-166-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-142-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-143-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-144-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-146-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-147-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-148-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-149-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-151-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-152-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-154-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-153-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-150-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-145-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-137-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-155-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-156-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-157-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-158-0x0000000003200000-0x000000000371F000-memory.dmp

Filesize
5.1MB

Download
memory/4944-159-0x0000000000400000-0x00000000009E8000-memory.dmp

Filesize
5.9MB

Download
memory/4944-160-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-161-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-162-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-163-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-164-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-165-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-141-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-167-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-168-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-169-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-170-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-171-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-140-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-120-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-138-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-136-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-135-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-134-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-132-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-133-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-131-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-130-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-129-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-128-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-127-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-126-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-125-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-124-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-123-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-122-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-121-0x0000000077D50000-0x0000000077EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-386-0x0000000000400000-0x00000000009E8000-memory.dmp

Filesize
5.9MB

Download
memory/4944-387-0x0000000000400000-0x00000000009E8000-memory.dmp

Filesize
5.9MB

Download