Analysis
- max time kernel
104s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
- submitted
30/06/2023, 00:06
General
- Target 8eca708367942803dd00ee83d0a3944f.exe
- Size 371KB
- Sample230630-adqrfage41
- SHA256 43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eca708367942803dd00ee83d0a3944f.exe"C:\Users\Admin\AppData\Local\Temp\8eca708367942803dd00ee83d0a3944f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 12202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2044 -ip 20441⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2044-134-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/2044-135-0x0000000004AF0000-0x0000000005094000-memory.dmp
memory/2044-136-0x0000000005130000-0x0000000005748000-memory.dmp
memory/2044-137-0x00000000057F0000-0x0000000005802000-memory.dmp
memory/2044-138-0x0000000005810000-0x000000000591A000-memory.dmp
memory/2044-139-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2044-140-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2044-142-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2044-141-0x0000000005920000-0x000000000595C000-memory.dmp
memory/2044-143-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2044-144-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/2044-145-0x0000000006330000-0x00000000063C2000-memory.dmp
memory/2044-146-0x00000000063D0000-0x0000000006446000-memory.dmp
memory/2044-147-0x0000000006490000-0x0000000006652000-memory.dmp
memory/2044-148-0x0000000006670000-0x0000000006B9C000-memory.dmp
memory/2044-149-0x0000000006CA0000-0x0000000006CBE000-memory.dmp
memory/2044-150-0x0000000007AC0000-0x0000000007B10000-memory.dmp
memory/2044-152-0x0000000000400000-0x0000000000472000-memory.dmp