Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 08:06

General

  • Target

    5aabceb5e22bcf0c55065b23689d59cc.exe

  • Size

    384KB

  • MD5

    5aabceb5e22bcf0c55065b23689d59cc

  • SHA1

    3ef78ef9208937eaa88658ef6299026948057eda

  • SHA256

    a58085c322c3b652925c69fcb94127e0aa222b44e2938132ee81f4474b0d97d9

  • SHA512

    52d0e47f67baaecf45ad0b6b26b002b1ac12e81e82e39d4a41ef31f9ea5fac3d6f48f190e1bd495f1b7669febd38ec741d8d0678f5ad95d8cfad75e73cde3cfb

  • SSDEEP

    6144:pbF7DK61HJ5COEQ9VA7tvBgXjkUi5bmGboN9f:p5/K61pjz9VAhvGXmmGK9

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5aabceb5e22bcf0c55065b23689d59cc.exe
    "C:\Users\Admin\AppData\Local\Temp\5aabceb5e22bcf0c55065b23689d59cc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1300
      2⤵
      • Program crash
      PID:3944
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2564 -ip 2564
    1⤵
      PID:1676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2564-134-0x00000000025D0000-0x00000000026D0000-memory.dmp

      Filesize

      1024KB

    • memory/2564-135-0x00000000040A0000-0x00000000040DF000-memory.dmp

      Filesize

      252KB

    • memory/2564-136-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2564-137-0x00000000745F0000-0x0000000074DA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2564-139-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-138-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-140-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-141-0x0000000006B70000-0x0000000007114000-memory.dmp

      Filesize

      5.6MB

    • memory/2564-142-0x0000000007220000-0x0000000007838000-memory.dmp

      Filesize

      6.1MB

    • memory/2564-143-0x0000000007840000-0x000000000794A000-memory.dmp

      Filesize

      1.0MB

    • memory/2564-145-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-144-0x0000000006B40000-0x0000000006B52000-memory.dmp

      Filesize

      72KB

    • memory/2564-146-0x0000000007950000-0x000000000798C000-memory.dmp

      Filesize

      240KB

    • memory/2564-147-0x00000000025D0000-0x00000000026D0000-memory.dmp

      Filesize

      1024KB

    • memory/2564-148-0x00000000040A0000-0x00000000040DF000-memory.dmp

      Filesize

      252KB

    • memory/2564-149-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2564-150-0x00000000745F0000-0x0000000074DA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2564-152-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-153-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-154-0x0000000007C50000-0x0000000007CC6000-memory.dmp

      Filesize

      472KB

    • memory/2564-155-0x0000000007CD0000-0x0000000007D62000-memory.dmp

      Filesize

      584KB

    • memory/2564-156-0x0000000007D70000-0x0000000007DD6000-memory.dmp

      Filesize

      408KB

    • memory/2564-157-0x0000000008860000-0x00000000088B0000-memory.dmp

      Filesize

      320KB

    • memory/2564-158-0x00000000090F0000-0x00000000092B2000-memory.dmp

      Filesize

      1.8MB

    • memory/2564-159-0x00000000095A0000-0x0000000009ACC000-memory.dmp

      Filesize

      5.2MB

    • memory/2564-161-0x0000000006B60000-0x0000000006B70000-memory.dmp

      Filesize

      64KB

    • memory/2564-162-0x0000000000400000-0x0000000002308000-memory.dmp

      Filesize

      31.0MB

    • memory/2564-163-0x00000000745F0000-0x0000000074DA0000-memory.dmp

      Filesize

      7.7MB