Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 07:46
Static task
static1
Behavioral task
behavioral1
Sample
6cf2655af693736508e2dae8b2f337c4.exe
Resource
win7-20220812-en
General
-
Target
6cf2655af693736508e2dae8b2f337c4.exe
-
Size
416KB
-
MD5
6cf2655af693736508e2dae8b2f337c4
-
SHA1
1d9dba4f6d6a90e65051b3cd8fab265293097254
-
SHA256
3baf17a23a490f68f9a92415e0bdcd81162f3fec71775de9442817edfdff8a2e
-
SHA512
b42eb0d9047dfc805e5ae9808aa553868dd96e996f993f484aa1376255683eb6119d8cb5291c2256a568520537e9ea9c1a59a7b23a481c7e8f9e7a30ce1dc551
-
SSDEEP
6144:z+Ld6kR9TAN1h/dRX254GnKttJD9dVdrrJCR5ewj9/CJTk637eQfnd5oB:aBR5Azh/TNttRdCRFj9CJb7d5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4340 4640 WerFault.exe 6cf2655af693736508e2dae8b2f337c4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6cf2655af693736508e2dae8b2f337c4.exepid process 4640 6cf2655af693736508e2dae8b2f337c4.exe 4640 6cf2655af693736508e2dae8b2f337c4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6cf2655af693736508e2dae8b2f337c4.exedescription pid process Token: SeDebugPrivilege 4640 6cf2655af693736508e2dae8b2f337c4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cf2655af693736508e2dae8b2f337c4.exe"C:\Users\Admin\AppData\Local\Temp\6cf2655af693736508e2dae8b2f337c4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 12762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4640 -ip 46401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4640-132-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/4640-133-0x000000000071D000-0x000000000074C000-memory.dmpFilesize
188KB
-
memory/4640-134-0x00000000021C0000-0x000000000220B000-memory.dmpFilesize
300KB
-
memory/4640-135-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/4640-136-0x0000000005230000-0x0000000005848000-memory.dmpFilesize
6.1MB
-
memory/4640-137-0x0000000005890000-0x000000000599A000-memory.dmpFilesize
1.0MB
-
memory/4640-138-0x00000000059A0000-0x00000000059B2000-memory.dmpFilesize
72KB
-
memory/4640-139-0x00000000059C0000-0x00000000059FC000-memory.dmpFilesize
240KB
-
memory/4640-140-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/4640-141-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/4640-142-0x000000000071D000-0x000000000074C000-memory.dmpFilesize
188KB
-
memory/4640-143-0x0000000006680000-0x00000000066F6000-memory.dmpFilesize
472KB
-
memory/4640-144-0x0000000006710000-0x0000000006760000-memory.dmpFilesize
320KB
-
memory/4640-145-0x0000000006900000-0x0000000006AC2000-memory.dmpFilesize
1.8MB
-
memory/4640-146-0x0000000006AD0000-0x0000000006FFC000-memory.dmpFilesize
5.2MB
-
memory/4640-147-0x000000000071D000-0x000000000074C000-memory.dmpFilesize
188KB
-
memory/4640-148-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB