Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2023 12:30

General

  • Target

    f2f958748ed4e2ea045ea199926e77a82a7b17c801d9709ad1d485a77232c901.exe

  • Size

    373KB

  • MD5

    190a88a1c4798d1dc166375d2fadb207

  • SHA1

    71c62bb7dbd18b8093942fb8f9b4eb4d596e3efe

  • SHA256

    f2f958748ed4e2ea045ea199926e77a82a7b17c801d9709ad1d485a77232c901

  • SHA512

    b6616a5f81e679cb174a8332d50023061732700e5aebb8d65594f9626948dc2d69bbba770915902f8eabda9974ba94354d9802eb980664a5c85557047498b4a9

  • SSDEEP

    6144:CmpwvuLvSGltwuaf2Zu1UOrTiBpDBBI8uI3W0CLp11:BWvuj3HPJmb2pDPIlp

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2f958748ed4e2ea045ea199926e77a82a7b17c801d9709ad1d485a77232c901.exe
    "C:\Users\Admin\AppData\Local\Temp\f2f958748ed4e2ea045ea199926e77a82a7b17c801d9709ad1d485a77232c901.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1280
      2⤵
      • Program crash
      PID:2172
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2200 -ip 2200
    1⤵
      PID:2512

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2200-134-0x0000000002720000-0x0000000002820000-memory.dmp

      Filesize

      1024KB

    • memory/2200-135-0x00000000026D0000-0x000000000270F000-memory.dmp

      Filesize

      252KB

    • memory/2200-136-0x0000000000400000-0x000000000242E000-memory.dmp

      Filesize

      32.2MB

    • memory/2200-138-0x0000000006BC0000-0x0000000007164000-memory.dmp

      Filesize

      5.6MB

    • memory/2200-137-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-140-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-139-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-141-0x0000000074430000-0x0000000074BE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2200-142-0x0000000000400000-0x000000000242E000-memory.dmp

      Filesize

      32.2MB

    • memory/2200-143-0x0000000007320000-0x0000000007938000-memory.dmp

      Filesize

      6.1MB

    • memory/2200-144-0x0000000007940000-0x0000000007A4A000-memory.dmp

      Filesize

      1.0MB

    • memory/2200-146-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-145-0x0000000007A50000-0x0000000007A62000-memory.dmp

      Filesize

      72KB

    • memory/2200-147-0x0000000007A70000-0x0000000007AAC000-memory.dmp

      Filesize

      240KB

    • memory/2200-148-0x0000000002720000-0x0000000002820000-memory.dmp

      Filesize

      1024KB

    • memory/2200-149-0x00000000026D0000-0x000000000270F000-memory.dmp

      Filesize

      252KB

    • memory/2200-150-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-151-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-152-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-154-0x0000000074430000-0x0000000074BE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2200-155-0x0000000007D70000-0x0000000007DE6000-memory.dmp

      Filesize

      472KB

    • memory/2200-156-0x0000000007DF0000-0x0000000007E82000-memory.dmp

      Filesize

      584KB

    • memory/2200-157-0x0000000007E90000-0x0000000007EF6000-memory.dmp

      Filesize

      408KB

    • memory/2200-158-0x00000000086D0000-0x0000000008892000-memory.dmp

      Filesize

      1.8MB

    • memory/2200-159-0x00000000088B0000-0x0000000008DDC000-memory.dmp

      Filesize

      5.2MB

    • memory/2200-160-0x0000000008F30000-0x0000000008F80000-memory.dmp

      Filesize

      320KB

    • memory/2200-161-0x00000000043F0000-0x0000000004400000-memory.dmp

      Filesize

      64KB

    • memory/2200-163-0x0000000000400000-0x000000000242E000-memory.dmp

      Filesize

      32.2MB

    • memory/2200-164-0x0000000074430000-0x0000000074BE0000-memory.dmp

      Filesize

      7.7MB