Analysis
- max time kernel
140s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
01/08/2023, 16:17
General
- Target file.exe
- Size 368KB
- Sample230801-trclhsad7y
- SHA256 b805ee9e91c4716831f7f44ab17a2e58ec9f90c73be93cf7468fee62edcbc2d7
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 14282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2620 -ip 26201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2620-133-0x0000000004190000-0x00000000041B9000-memory.dmp
memory/2620-134-0x00000000041C0000-0x00000000041FF000-memory.dmp
memory/2620-135-0x0000000000400000-0x000000000244B000-memory.dmp
memory/2620-136-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/2620-137-0x0000000006C70000-0x0000000007214000-memory.dmp
memory/2620-138-0x0000000074FD0000-0x0000000075780000-memory.dmp
memory/2620-139-0x0000000007390000-0x00000000079A8000-memory.dmp
memory/2620-140-0x00000000079B0000-0x0000000007ABA000-memory.dmp
memory/2620-141-0x0000000004900000-0x0000000004912000-memory.dmp
memory/2620-142-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/2620-143-0x0000000007AC0000-0x0000000007AFC000-memory.dmp
memory/2620-144-0x0000000000400000-0x000000000244B000-memory.dmp
memory/2620-145-0x0000000004190000-0x00000000041B9000-memory.dmp
memory/2620-146-0x00000000041C0000-0x00000000041FF000-memory.dmp
memory/2620-147-0x0000000007DA0000-0x0000000007E16000-memory.dmp
memory/2620-148-0x0000000007E20000-0x0000000007EB2000-memory.dmp
memory/2620-149-0x0000000074FD0000-0x0000000075780000-memory.dmp
memory/2620-150-0x0000000007ED0000-0x0000000007F36000-memory.dmp
memory/2620-151-0x00000000087D0000-0x0000000008820000-memory.dmp
memory/2620-152-0x0000000008980000-0x0000000008B42000-memory.dmp
memory/2620-153-0x0000000008B50000-0x000000000907C000-memory.dmp
memory/2620-155-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/2620-157-0x0000000000400000-0x000000000244B000-memory.dmp
memory/2620-158-0x0000000074FD0000-0x0000000075780000-memory.dmp