244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc

Analysis

max time kernel
91s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2022 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe
Size

5.8MB
MD5

b940a9157e2f580bbaa7e691ea84d205
SHA1

8418876ca893537b99a940bfd09fcb06617c7cb6
SHA256

244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc
SHA512

4827644dd4389c56d44d09cef11b7c537fd92a1127fd940cf8b9ac2258203e6002ec9643fcc711257c3b1474e7655835c5faf60a45582ab3cf71077e2ef1d35f
SSDEEP

49152:qnV9xaGFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:qnV9xeSjL+EnHOMz5ysZA5+bf6c

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3676	4928	WerFault.exe	80
4180	4928	WerFault.exe	80
4292	4928	WerFault.exe	80
1056	4928	WerFault.exe	80
2468	4928	WerFault.exe	80
3992	4928	WerFault.exe	80
4052	4928	WerFault.exe	80
3116	4928	WerFault.exe	80
4880	4928	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4236	wmic.exe
Token: SeSecurityPrivilege	4236	wmic.exe
Token: SeTakeOwnershipPrivilege	4236	wmic.exe
Token: SeLoadDriverPrivilege	4236	wmic.exe
Token: SeSystemProfilePrivilege	4236	wmic.exe
Token: SeSystemtimePrivilege	4236	wmic.exe
Token: SeProfSingleProcessPrivilege	4236	wmic.exe
Token: SeIncBasePriorityPrivilege	4236	wmic.exe
Token: SeCreatePagefilePrivilege	4236	wmic.exe
Token: SeBackupPrivilege	4236	wmic.exe
Token: SeRestorePrivilege	4236	wmic.exe
Token: SeShutdownPrivilege	4236	wmic.exe
Token: SeDebugPrivilege	4236	wmic.exe
Token: SeSystemEnvironmentPrivilege	4236	wmic.exe
Token: SeRemoteShutdownPrivilege	4236	wmic.exe
Token: SeUndockPrivilege	4236	wmic.exe
Token: SeManageVolumePrivilege	4236	wmic.exe
Token: 33	4236	wmic.exe
Token: 34	4236	wmic.exe
Token: 35	4236	wmic.exe
Token: 36	4236	wmic.exe
Token: SeIncreaseQuotaPrivilege	4236	wmic.exe
Token: SeSecurityPrivilege	4236	wmic.exe
Token: SeTakeOwnershipPrivilege	4236	wmic.exe
Token: SeLoadDriverPrivilege	4236	wmic.exe
Token: SeSystemProfilePrivilege	4236	wmic.exe
Token: SeSystemtimePrivilege	4236	wmic.exe
Token: SeProfSingleProcessPrivilege	4236	wmic.exe
Token: SeIncBasePriorityPrivilege	4236	wmic.exe
Token: SeCreatePagefilePrivilege	4236	wmic.exe
Token: SeBackupPrivilege	4236	wmic.exe
Token: SeRestorePrivilege	4236	wmic.exe
Token: SeShutdownPrivilege	4236	wmic.exe
Token: SeDebugPrivilege	4236	wmic.exe
Token: SeSystemEnvironmentPrivilege	4236	wmic.exe
Token: SeRemoteShutdownPrivilege	4236	wmic.exe
Token: SeUndockPrivilege	4236	wmic.exe
Token: SeManageVolumePrivilege	4236	wmic.exe
Token: 33	4236	wmic.exe
Token: 34	4236	wmic.exe
Token: 35	4236	wmic.exe
Token: 36	4236	wmic.exe
Token: SeIncreaseQuotaPrivilege	2308	WMIC.exe
Token: SeSecurityPrivilege	2308	WMIC.exe
Token: SeTakeOwnershipPrivilege	2308	WMIC.exe
Token: SeLoadDriverPrivilege	2308	WMIC.exe
Token: SeSystemProfilePrivilege	2308	WMIC.exe
Token: SeSystemtimePrivilege	2308	WMIC.exe
Token: SeProfSingleProcessPrivilege	2308	WMIC.exe
Token: SeIncBasePriorityPrivilege	2308	WMIC.exe
Token: SeCreatePagefilePrivilege	2308	WMIC.exe
Token: SeBackupPrivilege	2308	WMIC.exe
Token: SeRestorePrivilege	2308	WMIC.exe
Token: SeShutdownPrivilege	2308	WMIC.exe
Token: SeDebugPrivilege	2308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2308	WMIC.exe
Token: SeRemoteShutdownPrivilege	2308	WMIC.exe
Token: SeUndockPrivilege	2308	WMIC.exe
Token: SeManageVolumePrivilege	2308	WMIC.exe
Token: 33	2308	WMIC.exe
Token: 34	2308	WMIC.exe
Token: 35	2308	WMIC.exe
Token: 36	2308	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2308	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4236	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	100
PID 4928 wrote to memory of 4236	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	100
PID 4928 wrote to memory of 4236	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	100
PID 4928 wrote to memory of 2804	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	106
PID 4928 wrote to memory of 2804	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	106
PID 4928 wrote to memory of 2804	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	106
PID 2804 wrote to memory of 2308	2804	cmd.exe	108
PID 2804 wrote to memory of 2308	2804	cmd.exe	108
PID 2804 wrote to memory of 2308	2804	cmd.exe	108
PID 4928 wrote to memory of 4568	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	109
PID 4928 wrote to memory of 4568	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	109
PID 4928 wrote to memory of 4568	4928	244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe	109
PID 4568 wrote to memory of 1488	4568	cmd.exe	111
PID 4568 wrote to memory of 1488	4568	cmd.exe	111
PID 4568 wrote to memory of 1488	4568	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe
"C:\Users\Admin\AppData\Local\Temp\244d4d8b53a0e0c9ff019c8cf4f0004a4960e46357a89f73be2201e6f6c384cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 560
  2⤵
  - Program crash
  PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 564
  2⤵
  - Program crash
  PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 564
  2⤵
  - Program crash
  PID:4292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 644
  2⤵
  - Program crash
  PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 820
  2⤵
  - Program crash
  PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 868
  2⤵
  - Program crash
  PID:3992
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1328
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1316
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 152
  2⤵
  - Program crash
  PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4928 -ip 4928
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4928 -ip 4928
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4928 -ip 4928
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4928 -ip 4928
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4928 -ip 4928
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4928 -ip 4928
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4928 -ip 4928
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 4928
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-132-0x00000000032D0000-0x00000000037EF000-memory.dmp

Filesize
5.1MB

Download
memory/4928-133-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download
memory/4928-139-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download