Analysis
- max time kernel
135s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
15/06/2023, 18:40
General
- Target file.exe
- Size 317KB
- Sample230615-xa7bcaag66
- SHA256 65e415cb9fd742853af3e2d0dda418adb799d61e8a8a806d2d28802c4f8975d0
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 12842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3620 -ip 36201⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3620-134-0x0000000002200000-0x000000000223F000-memory.dmp
memory/3620-135-0x0000000004C90000-0x0000000005234000-memory.dmp
memory/3620-137-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-136-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-138-0x000000000A730000-0x000000000AD48000-memory.dmp
memory/3620-139-0x000000000ADA0000-0x000000000AEAA000-memory.dmp
memory/3620-140-0x000000000AEE0000-0x000000000AEF2000-memory.dmp
memory/3620-141-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-142-0x000000000AF00000-0x000000000AF3C000-memory.dmp
memory/3620-143-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3620-144-0x000000000B200000-0x000000000B276000-memory.dmp
memory/3620-145-0x000000000B280000-0x000000000B312000-memory.dmp
memory/3620-146-0x000000000B320000-0x000000000B386000-memory.dmp
memory/3620-147-0x000000000BB40000-0x000000000BD02000-memory.dmp
memory/3620-148-0x000000000BD20000-0x000000000C24C000-memory.dmp
memory/3620-149-0x0000000002200000-0x000000000223F000-memory.dmp
memory/3620-150-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-151-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-152-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-153-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3620-154-0x00000000025C0000-0x0000000002610000-memory.dmp
memory/3620-156-0x0000000000400000-0x00000000004C5000-memory.dmp