Analysis
- max time kernel
95s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
31/05/2023, 08:27
General
- Target ae579f1a57697818ade5962f67398437.exe
- Size 491KB
- Sample230531-kceynadg49
- SHA256 ddad7b5c4546bd2bc27d66de61d76e788e48dbcdbafc1a5a4129e61c2dcc3721
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ae579f1a57697818ade5962f67398437.exe"C:\Users\Admin\AppData\Local\Temp\ae579f1a57697818ade5962f67398437.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9643⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3360 -ip 33601⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/208-155-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-157-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-162-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-161-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-138-0x00000220C2C90000-0x00000220C2C93000-memory.dmp
memory/208-160-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-159-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-158-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-150-0x00000220C2EF0000-0x00000220C2EF7000-memory.dmp
memory/208-152-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-154-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-151-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/208-149-0x00000220C2C90000-0x00000220C2C93000-memory.dmp
memory/208-153-0x00007FF4B2FD0000-0x00007FF4B30FD000-memory.dmp
memory/3360-135-0x0000000000870000-0x0000000000877000-memory.dmp
memory/3360-134-0x0000000002350000-0x00000000023C0000-memory.dmp
memory/3360-148-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3360-146-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3360-145-0x0000000002660000-0x0000000002696000-memory.dmp
memory/3360-139-0x0000000002660000-0x0000000002696000-memory.dmp
memory/3360-137-0x0000000002840000-0x0000000002C40000-memory.dmp
memory/3360-136-0x0000000002840000-0x0000000002C40000-memory.dmp