Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2023 09:38
Static task
static1
Behavioral task
behavioral1
Sample
73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5.exe
Resource
win7-20220901-en
General
-
Target
73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5.exe
-
Size
248KB
-
MD5
d4371171249f45f3af6095825378c055
-
SHA1
7c38214ddc9fdf6598f5247272997dd682147717
-
SHA256
73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5
-
SHA512
96f1118afbc83d3738ac00e4b9b9e08f9773fa47edcd422d9951168341f61a63c1e388d775595a23325b6a227a0704a333de14855286cc7a13bc37406b8aba22
-
SSDEEP
3072:cYXykb1N+5d5bGN9i8olYgxTNsRUd62GSHfSokyxMTZrVwb+sbi:cs9N+ZGNZFgxTN8c629/SokwMFr
Malware Config
Extracted
lumma
77.73.134.68
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4592 1716 WerFault.exe 73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5.exe"C:\Users\Admin\AppData\Local\Temp\73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5.exe"1⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 13562⤵
- Program crash
PID:4592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1716 -ip 17161⤵PID:4568
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-132-0x0000000002DA8000-0x0000000002DC2000-memory.dmpFilesize
104KB
-
memory/1716-133-0x0000000002D00000-0x0000000002D2A000-memory.dmpFilesize
168KB
-
memory/1716-134-0x0000000000400000-0x0000000002BA6000-memory.dmpFilesize
39.6MB
-
memory/1716-135-0x0000000000400000-0x0000000002BA6000-memory.dmpFilesize
39.6MB