Analysis
-
max time kernel
112s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 07:02
Static task
static1
Behavioral task
behavioral1
Sample
0e2f23e9e9711230ef7d10373a10c635.exe
Resource
win7-20221111-en
General
-
Target
0e2f23e9e9711230ef7d10373a10c635.exe
-
Size
335KB
-
MD5
0e2f23e9e9711230ef7d10373a10c635
-
SHA1
9f1f3d5e9cbdb8003f241dd30c27e28fc84df8a4
-
SHA256
0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c
-
SHA512
c56bbb2cbc4831a7d90cca742afb60e756d52503dd2000da339e3bc25f87967d1ba35a71b8554921d8483329d6342fca9718c4ceb4c87f9b21fe0c1832b6881b
-
SSDEEP
6144:13bFCLaAvsdg/MjX6O8APax4kHByIysADFRxLe9sczWGUq:13bA+AvsaMj7aqpRD7xC9TC
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2148 4572 WerFault.exe 0e2f23e9e9711230ef7d10373a10c635.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0e2f23e9e9711230ef7d10373a10c635.exepid process 4572 0e2f23e9e9711230ef7d10373a10c635.exe 4572 0e2f23e9e9711230ef7d10373a10c635.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0e2f23e9e9711230ef7d10373a10c635.exedescription pid process Token: SeDebugPrivilege 4572 0e2f23e9e9711230ef7d10373a10c635.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e2f23e9e9711230ef7d10373a10c635.exe"C:\Users\Admin\AppData\Local\Temp\0e2f23e9e9711230ef7d10373a10c635.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 12682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4572 -ip 45721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4572-132-0x0000000007420000-0x00000000079C4000-memory.dmpFilesize
5.6MB
-
memory/4572-133-0x0000000002CF9000-0x0000000002D27000-memory.dmpFilesize
184KB
-
memory/4572-134-0x0000000004900000-0x000000000494B000-memory.dmpFilesize
300KB
-
memory/4572-135-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/4572-136-0x00000000079D0000-0x0000000007FE8000-memory.dmpFilesize
6.1MB
-
memory/4572-137-0x0000000007FF0000-0x00000000080FA000-memory.dmpFilesize
1.0MB
-
memory/4572-138-0x00000000073E0000-0x00000000073F2000-memory.dmpFilesize
72KB
-
memory/4572-139-0x0000000008100000-0x000000000813C000-memory.dmpFilesize
240KB
-
memory/4572-140-0x00000000083E0000-0x0000000008472000-memory.dmpFilesize
584KB
-
memory/4572-141-0x0000000008480000-0x00000000084E6000-memory.dmpFilesize
408KB
-
memory/4572-142-0x0000000008DD0000-0x0000000008E46000-memory.dmpFilesize
472KB
-
memory/4572-143-0x0000000008E60000-0x0000000008EB0000-memory.dmpFilesize
320KB
-
memory/4572-144-0x0000000009000000-0x00000000091C2000-memory.dmpFilesize
1.8MB
-
memory/4572-145-0x00000000091E0000-0x000000000970C000-memory.dmpFilesize
5.2MB
-
memory/4572-146-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB