Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/02/2023, 14:01
General
-
Target
fc751b5c63935482746c70081d6c8c18efa5e96b0c55fb9320bf7c7f1758f436.exe
-
Size
418KB
-
MD5
734380a6efe3062d42ce92ca5d48109e
-
SHA1
265a1c914dcb026c40ea7b1c3f47446a4cf037a7
-
SHA256
fc751b5c63935482746c70081d6c8c18efa5e96b0c55fb9320bf7c7f1758f436
-
SHA512
6cc2dc912f6eb2f08f4e41cce1bcbd477d79177c577c34f2306e5c5cfac4cc19cbd2c94ac45a5a622bf2790ff13af4e47e86a7d7e7dae7ee830d21bcddb24e31
-
SSDEEP
6144:iGLZgWEsZBNppfc/ejsKyW7gDo+TqnHPnMLhLDJrAClRkNQJ:iGtg+pfJjsNBDnuH/MBDplmk
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc751b5c63935482746c70081d6c8c18efa5e96b0c55fb9320bf7c7f1758f436.exe"C:\Users\Admin\AppData\Local\Temp\fc751b5c63935482746c70081d6c8c18efa5e96b0c55fb9320bf7c7f1758f436.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 12202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3440 -ip 34401⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
-
Filesize
392KB
-
Filesize
528KB
-
Filesize
5.6MB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
180KB
-
Filesize
528KB