Analysis
-
max time kernel
159s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2023, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe
Resource
win7-20230220-en
General
-
Target
a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe
-
Size
411KB
-
MD5
2bfe72f3bd5b7848d3ca61bad997a3de
-
SHA1
d8fcab3490d957cc9fc9057575dfe0ea6f1574d6
-
SHA256
a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444
-
SHA512
19e3a5e9acdc6edb4167e00f54035e6d36ce32fff0d9cee535667df9fdf8449779f214ca0cee438d7046ec6fd500ecaed51fae813d15bff87a16ddc3f4ce1803
-
SSDEEP
6144:K5DLzs7DpO4NIS5bCwEU74DMCJQiMZrMHkr4Qhw:KV/s7DcIIS5uy7qMhiMZMHA4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4700 1392 WerFault.exe 80 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1392 a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1392 a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe"C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 12482⤵
- Program crash
PID:4700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1392 -ip 13921⤵PID:228