Analysis
-
max time kernel
101s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
5954ba19214d4d4fc7350c2476a938fe.exe
Resource
win7-20220901-en
General
-
Target
5954ba19214d4d4fc7350c2476a938fe.exe
-
Size
351KB
-
MD5
5954ba19214d4d4fc7350c2476a938fe
-
SHA1
9dd382dd17bc6eb7e8803c32c77ea27f16b07ad3
-
SHA256
bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5
-
SHA512
7aebeb535b6c725bdc417eaaee1489947154379ecd65514626f4ace57f4ceeab9d1c9e59edb58b9f1d96c3fc480d8c48ef896a8281fb143d32b33c81cea325f8
-
SSDEEP
6144:+QGsSYLKS0eHEYxn2vs1E/F9wWc30y3MRJbQd3PCtQb:+QGsSYyeli/A0PRJ+/Ct
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3412 924 WerFault.exe 5954ba19214d4d4fc7350c2476a938fe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5954ba19214d4d4fc7350c2476a938fe.exepid process 924 5954ba19214d4d4fc7350c2476a938fe.exe 924 5954ba19214d4d4fc7350c2476a938fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5954ba19214d4d4fc7350c2476a938fe.exedescription pid process Token: SeDebugPrivilege 924 5954ba19214d4d4fc7350c2476a938fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5954ba19214d4d4fc7350c2476a938fe.exe"C:\Users\Admin\AppData\Local\Temp\5954ba19214d4d4fc7350c2476a938fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 12722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 924 -ip 9241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/924-132-0x0000000000932000-0x0000000000963000-memory.dmpFilesize
196KB
-
memory/924-133-0x0000000000840000-0x000000000087E000-memory.dmpFilesize
248KB
-
memory/924-134-0x0000000000400000-0x00000000005B6000-memory.dmpFilesize
1.7MB
-
memory/924-135-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/924-136-0x0000000004C20000-0x0000000004CB2000-memory.dmpFilesize
584KB
-
memory/924-137-0x00000000054D0000-0x0000000005AE8000-memory.dmpFilesize
6.1MB
-
memory/924-138-0x0000000005AF0000-0x0000000005BFA000-memory.dmpFilesize
1.0MB
-
memory/924-139-0x0000000005440000-0x0000000005452000-memory.dmpFilesize
72KB
-
memory/924-140-0x0000000005460000-0x000000000549C000-memory.dmpFilesize
240KB
-
memory/924-141-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/924-142-0x0000000000932000-0x0000000000963000-memory.dmpFilesize
196KB
-
memory/924-143-0x00000000066C0000-0x0000000006736000-memory.dmpFilesize
472KB
-
memory/924-144-0x0000000006760000-0x00000000067B0000-memory.dmpFilesize
320KB
-
memory/924-145-0x0000000007620000-0x00000000077E2000-memory.dmpFilesize
1.8MB
-
memory/924-146-0x00000000077F0000-0x0000000007D1C000-memory.dmpFilesize
5.2MB
-
memory/924-147-0x0000000000932000-0x0000000000963000-memory.dmpFilesize
196KB
-
memory/924-148-0x0000000000400000-0x00000000005B6000-memory.dmpFilesize
1.7MB