Analysis
- max time kernel
99s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
31/05/2023, 08:28
General
- Target 5a6cbe35bd3626ab7d186f63740c956e.exe
- Size 434KB
- Sample230531-kc1v5aec2x
- SHA256 1184aeff512cf6da48a3c5357936da4f5488923f2327236be314d704e4cccdea
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5a6cbe35bd3626ab7d186f63740c956e.exe"C:\Users\Admin\AppData\Local\Temp\5a6cbe35bd3626ab7d186f63740c956e.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 9803⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3132 -ip 31321⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3132-147-0x0000000000400000-0x00000000006B3000-memory.dmp
memory/3132-135-0x0000000002480000-0x0000000002487000-memory.dmp
memory/3132-136-0x0000000002790000-0x0000000002B90000-memory.dmp
memory/3132-137-0x0000000002790000-0x0000000002B90000-memory.dmp
memory/3132-134-0x0000000000850000-0x00000000008C0000-memory.dmp
memory/3132-139-0x00000000034D0000-0x0000000003506000-memory.dmp
memory/3132-145-0x00000000034D0000-0x0000000003506000-memory.dmp
memory/4324-150-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-154-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-149-0x00000138E2030000-0x00000138E2037000-memory.dmp
memory/4324-138-0x00000138E1DD0000-0x00000138E1DD3000-memory.dmp
memory/4324-151-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-152-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-153-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-148-0x00000138E1DD0000-0x00000138E1DD3000-memory.dmp
memory/4324-156-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-157-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-158-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-159-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-160-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp
memory/4324-161-0x00007FF406CB0000-0x00007FF406DDD000-memory.dmp