Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2023 18:24

General

  • Target

    847355f35846ae16e0ed391cbfab69405ebd8368af26f61898ce10d4e061c4cc.exe

  • Size

    386KB

  • MD5

    9e8379901e9c212e9cd1088a5789660e

  • SHA1

    287ba566bd1d8f168af90f4fedf42d0d7636437e

  • SHA256

    847355f35846ae16e0ed391cbfab69405ebd8368af26f61898ce10d4e061c4cc

  • SHA512

    1d959fcb0930e335a29549b7ecbd6ef35a404d5c358050d419001bf5ae313f87516b35b5be7dddd5ce30cc53626ee5b88cc28f98bdc91f25952b4c29783d49dd

  • SSDEEP

    6144:AvWK5gX4WJGPgsULzyvMpSZETl/7AFSGOe:AOKyjAPFCzl50FSG

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\847355f35846ae16e0ed391cbfab69405ebd8368af26f61898ce10d4e061c4cc.exe
    "C:\Users\Admin\AppData\Local\Temp\847355f35846ae16e0ed391cbfab69405ebd8368af26f61898ce10d4e061c4cc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 1924
      2⤵
      • Program crash
      PID:3796
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2160 -ip 2160
    1⤵
      PID:4604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2160-134-0x0000000002580000-0x0000000002680000-memory.dmp

      Filesize

      1024KB

    • memory/2160-135-0x00000000024B0000-0x00000000024EF000-memory.dmp

      Filesize

      252KB

    • memory/2160-136-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/2160-137-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-138-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2160-140-0x0000000006B60000-0x0000000007104000-memory.dmp

      Filesize

      5.6MB

    • memory/2160-139-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-141-0x0000000007210000-0x0000000007828000-memory.dmp

      Filesize

      6.1MB

    • memory/2160-142-0x0000000007830000-0x000000000793A000-memory.dmp

      Filesize

      1.0MB

    • memory/2160-144-0x0000000007940000-0x0000000007952000-memory.dmp

      Filesize

      72KB

    • memory/2160-143-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-145-0x0000000007960000-0x000000000799C000-memory.dmp

      Filesize

      240KB

    • memory/2160-146-0x0000000002580000-0x0000000002680000-memory.dmp

      Filesize

      1024KB

    • memory/2160-147-0x00000000024B0000-0x00000000024EF000-memory.dmp

      Filesize

      252KB

    • memory/2160-148-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/2160-150-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-151-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2160-152-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-153-0x0000000007C30000-0x0000000007CA6000-memory.dmp

      Filesize

      472KB

    • memory/2160-154-0x0000000007CB0000-0x0000000007D42000-memory.dmp

      Filesize

      584KB

    • memory/2160-155-0x0000000007D60000-0x0000000007DC6000-memory.dmp

      Filesize

      408KB

    • memory/2160-156-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-157-0x0000000004350000-0x0000000004360000-memory.dmp

      Filesize

      64KB

    • memory/2160-158-0x0000000009690000-0x0000000009852000-memory.dmp

      Filesize

      1.8MB

    • memory/2160-159-0x0000000009860000-0x0000000009D8C000-memory.dmp

      Filesize

      5.2MB

    • memory/2160-160-0x00000000089D0000-0x0000000008A20000-memory.dmp

      Filesize

      320KB

    • memory/2160-162-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/2160-163-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB