Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 18:23
Behavioral task
behavioral1
Sample
3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af.dll
Resource
win10v2004-20220812-en
General
-
Target
3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af.dll
-
Size
126KB
-
MD5
507e9dc7b9c42f535b6df96d79179835
-
SHA1
acf41fb549750023115f060071aa5ca8c33f249e
-
SHA256
3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
-
SHA512
70907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
SSDEEP
3072:Yx7pOYzBekK3tiINwyP7XSSJds3zhrjPcnqULv4G9:Yx7ZNhK3vwyOztPc3L
Malware Config
Signatures
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 836 1192 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2592 wrote to memory of 1192 2592 rundll32.exe rundll32.exe PID 2592 wrote to memory of 1192 2592 rundll32.exe rundll32.exe PID 2592 wrote to memory of 1192 2592 rundll32.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af.dll,#12⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:1192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 8643⤵
- Program crash
PID:836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1192 -ip 11921⤵PID:3792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-132-0x0000000000000000-mapping.dmp