Analysis
-
max time kernel
91s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 10:35
Static task
static1
General
-
Target
06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe
-
Size
442KB
-
MD5
0baa4fca4d1351ee26aee097db6821ec
-
SHA1
8640d91336343965de301f937353d2252e27345b
-
SHA256
06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa
-
SHA512
44c4c02d33da4c370ccfcaee44986e920d6216bac85ee0891c357bfa86d2d2e04e6e4714f59d0b82b98cdf51442becf3c799e10440d8dca711252e56097e8748
-
SSDEEP
12288:KaR5Fc90ibMcoH6qCBz+DR7VWR5lz5ZX:n5W9LbjoaqCEDR7VWR5V7X
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3896 828 WerFault.exe 06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exepid process 828 06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exedescription pid process Token: SeDebugPrivilege 828 06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe"C:\Users\Admin\AppData\Local\Temp\06651c8f16bbef7b746a584c85ff03637e6ecc131b725b24168e7cf08726cefa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 15562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 828 -ip 8281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-132-0x000000000053E000-0x000000000056D000-memory.dmpFilesize
188KB
-
memory/828-133-0x00000000021D0000-0x000000000221B000-memory.dmpFilesize
300KB
-
memory/828-134-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/828-135-0x0000000004C60000-0x0000000005204000-memory.dmpFilesize
5.6MB
-
memory/828-136-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/828-137-0x0000000005850000-0x000000000595A000-memory.dmpFilesize
1.0MB
-
memory/828-138-0x0000000005990000-0x00000000059A2000-memory.dmpFilesize
72KB
-
memory/828-139-0x00000000059B0000-0x00000000059EC000-memory.dmpFilesize
240KB
-
memory/828-140-0x0000000005CA0000-0x0000000005D32000-memory.dmpFilesize
584KB
-
memory/828-141-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/828-142-0x000000000053E000-0x000000000056D000-memory.dmpFilesize
188KB
-
memory/828-143-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/828-144-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/828-145-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/828-146-0x000000000053E000-0x000000000056D000-memory.dmpFilesize
188KB
-
memory/828-147-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB