Analysis
-
max time kernel
237s -
max time network
309s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:04
Behavioral task
behavioral1
Sample
adbaf286228c46522e50371c4be31a03.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
adbaf286228c46522e50371c4be31a03.dll
Resource
win10v2004-20221111-en
General
-
Target
adbaf286228c46522e50371c4be31a03.dll
-
Size
126KB
-
MD5
adbaf286228c46522e50371c4be31a03
-
SHA1
a29d644c4663b2e2b2bd92046ba0df629537c297
-
SHA256
d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
-
SHA512
74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
SSDEEP
3072:ox7pOYzBekBmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnm9:ox7ZNhB/dMq6AO0a7vVlT
Malware Config
Signatures
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1464 4140 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 920 wrote to memory of 4140 920 rundll32.exe rundll32.exe PID 920 wrote to memory of 4140 920 rundll32.exe rundll32.exe PID 920 wrote to memory of 4140 920 rundll32.exe rundll32.exe PID 4140 wrote to memory of 1464 4140 rundll32.exe WerFault.exe PID 4140 wrote to memory of 1464 4140 rundll32.exe WerFault.exe PID 4140 wrote to memory of 1464 4140 rundll32.exe WerFault.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adbaf286228c46522e50371c4be31a03.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adbaf286228c46522e50371c4be31a03.dll,#12⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4140 -ip 41401⤵