privateloader | 8553c192946ef081746e0576669a2b623739c09f1e7f6abd28b2bbd9913d7b60

General

Target

0aa2ce5aa03b2ab6ae2a237df03a4749.exe
Size

1.2MB
MD5

0aa2ce5aa03b2ab6ae2a237df03a4749
SHA1

e02f18371accf99ea2ac9249e36514457505f8f7
SHA256

8553c192946ef081746e0576669a2b623739c09f1e7f6abd28b2bbd9913d7b60
SHA512

c190d2fdf406b9a5a8451bff64b36a5419e111f1a15c1f824eced428fa4f7804eb6d603a1a8aaddc492e06cc2159ff7151fcb729f1ac518cd886cfae725c4619
SSDEEP

24576:zDRfA1dI+v0BpQf5AFKYnpqLVwoGe+g18KowLpQWicfLXQD4i84L:z9fA7lfePpKVwJe+mrQWNzXQD4iN

Score

10^/10

privateloader loader main spyware stealer

Malware Config

Extracted

Family

privateloader

C2

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

208.67.104.60

Attributes

payload_url
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0aa2ce5aa03b2ab6ae2a237df03a4749.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0aa2ce5aa03b2ab6ae2a237df03a4749.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ipinfo.io
36 api.db-ip.com
37 api.db-ip.com

flow	ioc
20	ipinfo.io
36	api.db-ip.com
37	api.db-ip.com

Drops file in System32 directory 4 IoCs

Processes:

0aa2ce5aa03b2ab6ae2a237df03a4749.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
File opened for modification	C:\Windows\System32\GroupPolicy	0aa2ce5aa03b2ab6ae2a237df03a4749.exe

Program crash 40 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4012	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1812	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3076	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2816	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3760	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4992	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2944	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4396	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4620	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
5032	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3864	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2876	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2684	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4056	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1756	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1492	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1652	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1572	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4704	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2040	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4136	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3028	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
260	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2408	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2804	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
5016	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3928	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4808	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
2472	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4700	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4280	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4172	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1060	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3016	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4148	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
1248	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4804	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4536	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
5072	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
3496	4728	WerFault.exe	0aa2ce5aa03b2ab6ae2a237df03a4749.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0aa2ce5aa03b2ab6ae2a237df03a4749.exe

pid process

4728 0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4728 0aa2ce5aa03b2ab6ae2a237df03a4749.exe

pid	process
4728	0aa2ce5aa03b2ab6ae2a237df03a4749.exe
4728	0aa2ce5aa03b2ab6ae2a237df03a4749.exe

C:\Users\Admin\AppData\Local\Temp\0aa2ce5aa03b2ab6ae2a237df03a4749.exe
"C:\Users\Admin\AppData\Local\Temp\0aa2ce5aa03b2ab6ae2a237df03a4749.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 612
2⤵
- Program crash
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 572
2⤵
- Program crash
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 712
2⤵
- Program crash
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 868
2⤵
- Program crash
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 580
2⤵
- Program crash
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 960
2⤵
- Program crash
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1204
2⤵
- Program crash
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1456
2⤵
- Program crash
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1320
2⤵
- Program crash
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1820
2⤵
- Program crash
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 840
2⤵
- Program crash
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1308
2⤵
- Program crash
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1888
2⤵
- Program crash
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1884
2⤵
- Program crash
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1912
2⤵
- Program crash
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1680
2⤵
- Program crash
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1584
2⤵
- Program crash
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1980
2⤵
- Program crash
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1604
2⤵
- Program crash
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1836
2⤵
- Program crash
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1836
2⤵
- Program crash
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1936
2⤵
- Program crash
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1600
2⤵
- Program crash
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1836
2⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1976
2⤵
- Program crash
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1816
2⤵
- Program crash
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2024
2⤵
- Program crash
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2036
2⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2008
2⤵
- Program crash
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2140
2⤵
- Program crash
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2120
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2144
2⤵
- Program crash
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2080
2⤵
- Program crash
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2168
2⤵
- Program crash
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2152
2⤵
- Program crash
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 720
2⤵
- Program crash
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2184
2⤵
- Program crash
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2204
2⤵
- Program crash
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2192
2⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2244
2⤵
- Program crash
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4728 -ip 4728
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4728 -ip 4728
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4728 -ip 4728
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4728 -ip 4728
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4728 -ip 4728
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4728 -ip 4728
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4728 -ip 4728
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4728 -ip 4728
1⤵
PID:616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4728 -ip 4728
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4728 -ip 4728
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4728 -ip 4728
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4728 -ip 4728
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4728 -ip 4728
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4728 -ip 4728
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4728 -ip 4728
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4728 -ip 4728
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4728 -ip 4728
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4728 -ip 4728
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4728 -ip 4728
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4728 -ip 4728
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4728 -ip 4728
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4728 -ip 4728
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4728 -ip 4728
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4728 -ip 4728
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4728 -ip 4728
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4728 -ip 4728
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4728 -ip 4728
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4728 -ip 4728
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4728 -ip 4728
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4728 -ip 4728
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4728 -ip 4728
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4728 -ip 4728
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4728 -ip 4728
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4728 -ip 4728
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4728 -ip 4728
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4728 -ip 4728
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4728 -ip 4728
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4728 -ip 4728
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4728 -ip 4728
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4728 -ip 4728
1⤵
PID:1472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4728-132-0x0000000000956000-0x0000000000A64000-memory.dmp

Filesize
1.1MB

Download
memory/4728-133-0x0000000002410000-0x0000000002661000-memory.dmp

Filesize
2.3MB

Download
memory/4728-134-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4728-135-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads