Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 23:36

General

  • Target

    f235938a2a7b1712ec278123f70f7529.exe

  • Size

    385KB

  • MD5

    f235938a2a7b1712ec278123f70f7529

  • SHA1

    28760a8523738bcfaf4e95b0de756d324ccc389d

  • SHA256

    e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6

  • SHA512

    c8ccaa244b7bd43fe9cfc68c3af17063d033726bf93a55311084d3ffd263606c2c0737b4e510073a7b4912de329cb51dbc9fe5d88c9238e57f7ec7240576c317

  • SSDEEP

    6144:FnIvVNP8yPuW/UbnW9Pl997LEZKxmEq1Admg5b5FIXc5iDd:Fn8BuW/UTWrQOsoxkJDd

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f235938a2a7b1712ec278123f70f7529.exe
    "C:\Users\Admin\AppData\Local\Temp\f235938a2a7b1712ec278123f70f7529.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1288
      2⤵
      • Program crash
      PID:228
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2100 -ip 2100
    1⤵
      PID:4420

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2100-134-0x00000000024E0000-0x00000000025E0000-memory.dmp

      Filesize

      1024KB

    • memory/2100-135-0x0000000002470000-0x00000000024AF000-memory.dmp

      Filesize

      252KB

    • memory/2100-136-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2100-137-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-138-0x0000000006AC0000-0x0000000007064000-memory.dmp

      Filesize

      5.6MB

    • memory/2100-140-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-139-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-141-0x0000000074600000-0x0000000074DB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2100-142-0x00000000071E0000-0x00000000077F8000-memory.dmp

      Filesize

      6.1MB

    • memory/2100-143-0x0000000007800000-0x000000000790A000-memory.dmp

      Filesize

      1.0MB

    • memory/2100-145-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-144-0x0000000007930000-0x0000000007942000-memory.dmp

      Filesize

      72KB

    • memory/2100-146-0x0000000007950000-0x000000000798C000-memory.dmp

      Filesize

      240KB

    • memory/2100-147-0x00000000024E0000-0x00000000025E0000-memory.dmp

      Filesize

      1024KB

    • memory/2100-148-0x0000000002470000-0x00000000024AF000-memory.dmp

      Filesize

      252KB

    • memory/2100-149-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2100-150-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-151-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-152-0x0000000007C50000-0x0000000007CC6000-memory.dmp

      Filesize

      472KB

    • memory/2100-153-0x0000000007CD0000-0x0000000007D62000-memory.dmp

      Filesize

      584KB

    • memory/2100-154-0x0000000007D70000-0x0000000007DD6000-memory.dmp

      Filesize

      408KB

    • memory/2100-155-0x0000000074600000-0x0000000074DB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2100-156-0x00000000087F0000-0x00000000089B2000-memory.dmp

      Filesize

      1.8MB

    • memory/2100-157-0x00000000089D0000-0x0000000008EFC000-memory.dmp

      Filesize

      5.2MB

    • memory/2100-158-0x0000000006AB0000-0x0000000006AC0000-memory.dmp

      Filesize

      64KB

    • memory/2100-159-0x000000000A020000-0x000000000A070000-memory.dmp

      Filesize

      320KB

    • memory/2100-161-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2100-162-0x0000000074600000-0x0000000074DB0000-memory.dmp

      Filesize

      7.7MB