2a9d2ee578beb9b61da312eebd4536980371a2030f5c5fdab883fb1f6f3b4aa5

Analysis

max time kernel
3s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a9d2ee578beb9b61da312eebd4536980371a2030f5c5fdab883fb1f6f3b4aa5.exe
Size

365KB
MD5

f14e55bd05db5ee4a296e6701526bf33
SHA1

da4b120ab625165c3864187615aeb0fb37398928
SHA256

2a9d2ee578beb9b61da312eebd4536980371a2030f5c5fdab883fb1f6f3b4aa5
SHA512

d51634a000543c7eba204f12b477cc2106f7e0619eca2165b6fc059116885b4596ac1072d4e629b2ca201b58d78342037901bdf3119c19b9dd677dca8092b0f9
SSDEEP

6144:ihk8knu5jGR85+DdLqDcrblgGBVwttYAs1PDy4jEfBd58hRrk62W66pnJVuaFdBY:iOJuxGO5SxBgGsYhm4a83rNpXpnJVNVY

Score

8^/10

discovery spyware stealer upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4804-132-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/files/0x000a000000022e63-137.dat	upx
behavioral2/files/0x000a000000022e63-136.dat	upx
behavioral2/memory/4868-139-0x0000000010000000-0x0000000010086000-memory.dmp	upx
behavioral2/memory/4804-140-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3444	4804	WerFault.exe	14

C:\Users\Admin\AppData\Local\Temp\2a9d2ee578beb9b61da312eebd4536980371a2030f5c5fdab883fb1f6f3b4aa5.exe
"C:\Users\Admin\AppData\Local\Temp\2a9d2ee578beb9b61da312eebd4536980371a2030f5c5fdab883fb1f6f3b4aa5.exe"
1⤵
PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 680
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe msivwz32.dll,BEXzMJ
  2⤵
  PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4804 -ip 4804
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msivwz32.dll

Filesize
14KB

MD5
7dd1f82e12b106672603581dd5f4de61

SHA1
603f2dc859c9ece89f2063dbc679ed051bae092b

SHA256
dcea48a440e00544b86a40397c591f80d4396baa219a0f566ff2bade81472f80

SHA512
fe59aff90d89291a69ca70dac6c13293393df9d6c661ec1c8292c0ad32539a31249244e583158646ba37e63e02e630934fbde8291b1a0a09e274ab55d2632c16

Download Submit
C:\Windows\SysWOW64\msivwz32.dll

Filesize
9KB

MD5
cab698f52735b30ea3326d85a260dbe8

SHA1
ea7520cbf18174a8fbbac12f1d6256b26636497e

SHA256
7bca1048449f5914c9a14e2d2078e7311f64ba5172a3d4cd71d2aa57cb25c0fe

SHA512
04051db1c004878093ac269e08ab0933bf0fc3bfcde4b733ec27e9d0078f8eff889052fa35b3c372751cc7177530b28c4e58a2983e84180096d9874048c877d6

Download Submit
memory/4804-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4804-133-0x0000000000A30000-0x0000000000A8A000-memory.dmp

Filesize
360KB

Download
memory/4804-138-0x0000000002920000-0x00000000029A6000-memory.dmp

Filesize
536KB

Download
memory/4804-134-0x0000000002920000-0x00000000029A6000-memory.dmp

Filesize
536KB

Download
memory/4804-140-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4868-139-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download