3a989ec907525ae8cb488002641bd24876c524141035430cb75562d08691f5c7

Analysis

max time kernel
61s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 18:54

Target

file.exe
Size

305KB
MD5

cbae5ce2d5c73d03569811c99b7e60d4
SHA1

465651b979221d10253bd6c648ba2448aded1340
SHA256

3a989ec907525ae8cb488002641bd24876c524141035430cb75562d08691f5c7
SHA512

711bef6fc5cb81205618535c727500b4fc6cd475c49005ffa15533fcc6624f0d5dc79d1d1e6f1d1bd2c641e5fe9d271dcd427d6ea7a6c3ce55bff90e9885d543
SSDEEP

3072:oGZ9Ri9WNrWCGjnKT0yOYAMUyXu58lAaUiKUzsg8fBy+hxB+qT3E6H4kV5aupHoV:oGRi9WLJT0yO6y0KUYfp3x/DH5l9Nd

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 4216	2120	file.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	2120	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	AppLaunch.exe
4216	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4216	2120	file.exe	84
PID 2120 wrote to memory of 4216	2120	file.exe	84
PID 2120 wrote to memory of 4216	2120	file.exe	84
PID 2120 wrote to memory of 4216	2120	file.exe	84
PID 2120 wrote to memory of 4216	2120	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 348
  2⤵
  - Program crash
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2120 -ip 2120
1⤵
PID:4808

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4216-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4216-138-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/4216-139-0x00000000029F0000-0x0000000002A02000-memory.dmp

Filesize
72KB

Download
memory/4216-140-0x0000000007440000-0x000000000754A000-memory.dmp

Filesize
1.0MB

Download
memory/4216-142-0x0000000007330000-0x000000000736C000-memory.dmp

Filesize
240KB

Download
memory/4216-141-0x0000000007410000-0x0000000007420000-memory.dmp

Filesize
64KB

Download
memory/4216-143-0x0000000007660000-0x00000000076C6000-memory.dmp

Filesize
408KB

Download
memory/4216-144-0x0000000008720000-0x0000000008CC4000-memory.dmp

Filesize
5.6MB

Download
memory/4216-145-0x0000000008250000-0x00000000082E2000-memory.dmp

Filesize
584KB

Download
memory/4216-146-0x00000000082F0000-0x0000000008366000-memory.dmp

Filesize
472KB

Download
memory/4216-147-0x0000000008200000-0x000000000821E000-memory.dmp

Filesize
120KB

Download
memory/4216-148-0x0000000008530000-0x0000000008580000-memory.dmp

Filesize
320KB

Download
memory/4216-149-0x0000000008EA0000-0x0000000009062000-memory.dmp

Filesize
1.8MB

Download
memory/4216-150-0x00000000095A0000-0x0000000009ACC000-memory.dmp

Filesize
5.2MB

Download