b438c8014f5a5c3fe53b1e31eedfbeeb53f1769b6bdd01f7789b1f6fa563d761

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe
Size

5.8MB
MD5

86039bb089c75cf42a34c303c1d2b2a9
SHA1

da6dbbbf1a16ebb4ee0373894a6f7706caf576d4
SHA256

e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46
SHA512

d0d39f4c51be5531ff74c4255ca8832c8637b604c6bac8e76ea72f66b8f8a642cbdb46c8761a9b11f5f77b0aa7925307bda672bc3c4d5b956c92f0f802617cc8
SSDEEP

49152:qnV9xa5Fe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:qnV9xTSjL+EnHOMz5ysZA5+bf6c

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3112	4560	WerFault.exe	81
3496	4560	WerFault.exe	81
4784	4560	WerFault.exe	81
3676	4560	WerFault.exe	81
4176	4560	WerFault.exe	81
4696	4560	WerFault.exe	81
1164	4560	WerFault.exe	81
4084	4560	WerFault.exe	81
2664	4560	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1556	wmic.exe
Token: SeSecurityPrivilege	1556	wmic.exe
Token: SeTakeOwnershipPrivilege	1556	wmic.exe
Token: SeLoadDriverPrivilege	1556	wmic.exe
Token: SeSystemProfilePrivilege	1556	wmic.exe
Token: SeSystemtimePrivilege	1556	wmic.exe
Token: SeProfSingleProcessPrivilege	1556	wmic.exe
Token: SeIncBasePriorityPrivilege	1556	wmic.exe
Token: SeCreatePagefilePrivilege	1556	wmic.exe
Token: SeBackupPrivilege	1556	wmic.exe
Token: SeRestorePrivilege	1556	wmic.exe
Token: SeShutdownPrivilege	1556	wmic.exe
Token: SeDebugPrivilege	1556	wmic.exe
Token: SeSystemEnvironmentPrivilege	1556	wmic.exe
Token: SeRemoteShutdownPrivilege	1556	wmic.exe
Token: SeUndockPrivilege	1556	wmic.exe
Token: SeManageVolumePrivilege	1556	wmic.exe
Token: 33	1556	wmic.exe
Token: 34	1556	wmic.exe
Token: 35	1556	wmic.exe
Token: 36	1556	wmic.exe
Token: SeIncreaseQuotaPrivilege	1556	wmic.exe
Token: SeSecurityPrivilege	1556	wmic.exe
Token: SeTakeOwnershipPrivilege	1556	wmic.exe
Token: SeLoadDriverPrivilege	1556	wmic.exe
Token: SeSystemProfilePrivilege	1556	wmic.exe
Token: SeSystemtimePrivilege	1556	wmic.exe
Token: SeProfSingleProcessPrivilege	1556	wmic.exe
Token: SeIncBasePriorityPrivilege	1556	wmic.exe
Token: SeCreatePagefilePrivilege	1556	wmic.exe
Token: SeBackupPrivilege	1556	wmic.exe
Token: SeRestorePrivilege	1556	wmic.exe
Token: SeShutdownPrivilege	1556	wmic.exe
Token: SeDebugPrivilege	1556	wmic.exe
Token: SeSystemEnvironmentPrivilege	1556	wmic.exe
Token: SeRemoteShutdownPrivilege	1556	wmic.exe
Token: SeUndockPrivilege	1556	wmic.exe
Token: SeManageVolumePrivilege	1556	wmic.exe
Token: 33	1556	wmic.exe
Token: 34	1556	wmic.exe
Token: 35	1556	wmic.exe
Token: 36	1556	wmic.exe
Token: SeIncreaseQuotaPrivilege	4988	WMIC.exe
Token: SeSecurityPrivilege	4988	WMIC.exe
Token: SeTakeOwnershipPrivilege	4988	WMIC.exe
Token: SeLoadDriverPrivilege	4988	WMIC.exe
Token: SeSystemProfilePrivilege	4988	WMIC.exe
Token: SeSystemtimePrivilege	4988	WMIC.exe
Token: SeProfSingleProcessPrivilege	4988	WMIC.exe
Token: SeIncBasePriorityPrivilege	4988	WMIC.exe
Token: SeCreatePagefilePrivilege	4988	WMIC.exe
Token: SeBackupPrivilege	4988	WMIC.exe
Token: SeRestorePrivilege	4988	WMIC.exe
Token: SeShutdownPrivilege	4988	WMIC.exe
Token: SeDebugPrivilege	4988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4988	WMIC.exe
Token: SeRemoteShutdownPrivilege	4988	WMIC.exe
Token: SeUndockPrivilege	4988	WMIC.exe
Token: SeManageVolumePrivilege	4988	WMIC.exe
Token: 33	4988	WMIC.exe
Token: 34	4988	WMIC.exe
Token: 35	4988	WMIC.exe
Token: 36	4988	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4988	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1556	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	100
PID 4560 wrote to memory of 1556	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	100
PID 4560 wrote to memory of 1556	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	100
PID 4560 wrote to memory of 1372	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	106
PID 4560 wrote to memory of 1372	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	106
PID 4560 wrote to memory of 1372	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	106
PID 1372 wrote to memory of 4988	1372	cmd.exe	108
PID 1372 wrote to memory of 4988	1372	cmd.exe	108
PID 1372 wrote to memory of 4988	1372	cmd.exe	108
PID 4560 wrote to memory of 3108	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	109
PID 4560 wrote to memory of 3108	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	109
PID 4560 wrote to memory of 3108	4560	e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe	109
PID 3108 wrote to memory of 4808	3108	cmd.exe	111
PID 3108 wrote to memory of 4808	3108	cmd.exe	111
PID 3108 wrote to memory of 4808	3108	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe
"C:\Users\Admin\AppData\Local\Temp\e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 560
  2⤵
  - Program crash
  PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 584
  2⤵
  - Program crash
  PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 584
  2⤵
  - Program crash
  PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 584
  2⤵
  - Program crash
  PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 652
  2⤵
  - Program crash
  PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 868
  2⤵
  - Program crash
  PID:4696
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1320
  2⤵
  - Program crash
  PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1308
  2⤵
  - Program crash
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 152
  2⤵
  - Program crash
  PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4560 -ip 4560
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 4560
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4560 -ip 4560
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4560 -ip 4560
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4560 -ip 4560
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4560 -ip 4560
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4560 -ip 4560
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4560 -ip 4560
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4560 -ip 4560
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4560-132-0x00000000033B0000-0x00000000038CF000-memory.dmp

Filesize
5.1MB

Download
memory/4560-133-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download
memory/4560-139-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download