Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
19-07-2023 17:27
General
-
Target
91a0106c0b58cd6fde7a66bb181b3dbb.exe
-
Size
345KB
-
MD5
91a0106c0b58cd6fde7a66bb181b3dbb
-
SHA1
17bdbdb35a47154fec7fdfc4e9f59a053e5d5d7a
-
SHA256
84843ae0e91bbacae720437937f1bcea3fcae4d9933d71a07a26a8e81479c0f0
-
SHA512
de013483c8564801292d33a1103fbee5fa3ff41f21c4ddf447a870e5c1ee883bd15e95a2e7440c09b2a049e3578cec3d7f10d1182d4a30729790a1aa1ade5aab
-
SSDEEP
3072:AP2ZBBNQdf3BgVy/pC35i/fcax7YN9+SVtkwFn1oOKlOvJO2bNLg3r3XN3:zZRQN3Bg0GincaGhVtkU0sxOuq3
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\91a0106c0b58cd6fde7a66bb181b3dbb.exe"C:\Users\Admin\AppData\Local\Temp\91a0106c0b58cd6fde7a66bb181b3dbb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 12922⤵
- Program crash
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 484 -ip 4841⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
252KB
-
Filesize
39.4MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
6.1MB
-
Filesize
39.4MB
-
Filesize
1024KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
320KB
-
Filesize
39.4MB
-
Filesize
7.7MB