Analysis
- max time kernel
91s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
15/02/2023, 05:55
General
- Target f65c911f284ba6b8194b618fc649133b.exe
- Size 293KB
- Sample230215-gmffdsad88
- SHA256 d84774f8a9f2f7b6915aff68963dbd4f748a045eda5a61ebbed88c15134344b2
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f65c911f284ba6b8194b618fc649133b.exe"C:\Users\Admin\AppData\Local\Temp\f65c911f284ba6b8194b618fc649133b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 14722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 376 -ip 3761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-132-0x00000000009BE000-0x00000000009EC000-memory.dmp
memory/376-133-0x00000000024A0000-0x00000000024EB000-memory.dmp
memory/376-134-0x0000000004E70000-0x0000000005414000-memory.dmp
memory/376-135-0x0000000000400000-0x0000000000767000-memory.dmp
memory/376-136-0x00000000054A0000-0x0000000005AB8000-memory.dmp
memory/376-137-0x0000000005B40000-0x0000000005C4A000-memory.dmp
memory/376-138-0x0000000005C80000-0x0000000005C92000-memory.dmp
memory/376-139-0x0000000005CA0000-0x0000000005CDC000-memory.dmp
memory/376-140-0x0000000005F90000-0x0000000006022000-memory.dmp
memory/376-141-0x0000000006030000-0x0000000006096000-memory.dmp
memory/376-142-0x00000000009BE000-0x00000000009EC000-memory.dmp
memory/376-143-0x0000000006860000-0x00000000068D6000-memory.dmp
memory/376-144-0x00000000068F0000-0x0000000006940000-memory.dmp
memory/376-145-0x0000000006970000-0x0000000006B32000-memory.dmp
memory/376-146-0x0000000006B40000-0x000000000706C000-memory.dmp
memory/376-147-0x0000000000400000-0x0000000000767000-memory.dmp