Analysis
- max time kernel
84s - max time network
91s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
- submitted
29/06/2023, 08:41
General
- Target c86be0608ca0a4b00158a845db672d6c.exe
- Size 402KB
- Sample230629-klez1sce33
- SHA256 d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86be0608ca0a4b00158a845db672d6c.exe"C:\Users\Admin\AppData\Local\Temp\c86be0608ca0a4b00158a845db672d6c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 12162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2136 -ip 21361⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2136-134-0x0000000006200000-0x00000000067A4000-memory.dmp
memory/2136-135-0x0000000001CB0000-0x0000000001CED000-memory.dmp
memory/2136-136-0x00000000061F0000-0x0000000006200000-memory.dmp
memory/2136-137-0x00000000061F0000-0x0000000006200000-memory.dmp
memory/2136-138-0x00000000067B0000-0x0000000006DC8000-memory.dmp
memory/2136-139-0x00000000061C0000-0x00000000061D2000-memory.dmp
memory/2136-140-0x0000000006DD0000-0x0000000006EDA000-memory.dmp
memory/2136-141-0x0000000006EE0000-0x0000000006F1C000-memory.dmp
memory/2136-142-0x00000000061F0000-0x0000000006200000-memory.dmp
memory/2136-143-0x00000000071E0000-0x0000000007246000-memory.dmp
memory/2136-144-0x00000000079E0000-0x0000000007A72000-memory.dmp
memory/2136-145-0x0000000007AA0000-0x0000000007AF0000-memory.dmp
memory/2136-146-0x0000000007AF0000-0x0000000007B66000-memory.dmp
memory/2136-147-0x0000000007CE0000-0x0000000007CFE000-memory.dmp
memory/2136-148-0x0000000008AD0000-0x0000000008C92000-memory.dmp
memory/2136-149-0x0000000008CC0000-0x00000000091EC000-memory.dmp
memory/2136-151-0x0000000000400000-0x0000000001B66000-memory.dmp
memory/2136-152-0x00000000061F0000-0x0000000006200000-memory.dmp
memory/2136-153-0x00000000061F0000-0x0000000006200000-memory.dmp
memory/2136-154-0x00000000061F0000-0x0000000006200000-memory.dmp