Analysis
-
max time kernel
90s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 15:32
Static task
static1
Behavioral task
behavioral1
Sample
1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe
Resource
win7-20221111-en
General
-
Target
1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe
-
Size
394KB
-
MD5
85f3db6c910eca1089675f12eafae528
-
SHA1
c3f409f688e8c9924aae7b82e866d303bec3e54e
-
SHA256
1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771
-
SHA512
850d2902bacb2c321cd518f963d395dcb8b5af88f1599f22d5431a0849a82d6b7f009066824aba70703ab7c5bf1b86d01f4fcc8169c53994ff321a46f0a51ac2
-
SSDEEP
6144:P3OzLmZik1p5fIHhuO9OYmNaVIhUWI9Vp3F7f4VQY+vlr:PqiIWMBr9JWrhUWeVfzOQt
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3924 1608 WerFault.exe 1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exepid process 1608 1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe 1608 1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exedescription pid process Token: SeDebugPrivilege 1608 1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe"C:\Users\Admin\AppData\Local\Temp\1be8bdf5ca218b04927da47b456be4f720e87df3561db5754246779edfb92771.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 12562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1608 -ip 16081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1608-132-0x0000000004BA0000-0x0000000005144000-memory.dmpFilesize
5.6MB
-
memory/1608-135-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1608-134-0x0000000002200000-0x000000000224B000-memory.dmpFilesize
300KB
-
memory/1608-133-0x0000000000708000-0x0000000000736000-memory.dmpFilesize
184KB
-
memory/1608-137-0x0000000005850000-0x000000000595A000-memory.dmpFilesize
1.0MB
-
memory/1608-136-0x00000000051B0000-0x00000000057C8000-memory.dmpFilesize
6.1MB
-
memory/1608-138-0x0000000005990000-0x00000000059A2000-memory.dmpFilesize
72KB
-
memory/1608-139-0x00000000059B0000-0x00000000059EC000-memory.dmpFilesize
240KB
-
memory/1608-140-0x0000000005CA0000-0x0000000005D32000-memory.dmpFilesize
584KB
-
memory/1608-141-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/1608-142-0x0000000006450000-0x0000000006612000-memory.dmpFilesize
1.8MB
-
memory/1608-143-0x0000000006630000-0x0000000006B5C000-memory.dmpFilesize
5.2MB
-
memory/1608-144-0x0000000006CC0000-0x0000000006D36000-memory.dmpFilesize
472KB
-
memory/1608-145-0x0000000006D40000-0x0000000006D90000-memory.dmpFilesize
320KB
-
memory/1608-146-0x0000000000708000-0x0000000000736000-memory.dmpFilesize
184KB
-
memory/1608-147-0x0000000000708000-0x0000000000736000-memory.dmpFilesize
184KB
-
memory/1608-148-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB