Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2023 15:53

General

  • Target

    a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe

  • Size

    328KB

  • MD5

    31bb461f855c67b27b9020448da53173

  • SHA1

    37c0d18403289dea757e4fafade4121c4c88e02a

  • SHA256

    a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae

  • SHA512

    dfab15a4e413cf56c576c8c9b9b4f22a63f2c26d86f3828fd861fb5531804f017a61fd2dba647f13e8999326e2694e3009ad2a87b0d93cd0b73e7ff46706fd5e

  • SSDEEP

    6144:uriWgLjSV4lcBVKZLOgcv91F/Gkb3A1eeufwYukmQlgPkP+LjzfsBHc:uOWgfSV4lcBVKZzi1F/Gkb3Uu4YukmQx

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1780
      2⤵
      • Program crash
      PID:3608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4512 -ip 4512
    1⤵
      PID:4380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4512-133-0x0000000003630000-0x0000000003659000-memory.dmp

      Filesize

      164KB

    • memory/4512-134-0x0000000003660000-0x000000000369F000-memory.dmp

      Filesize

      252KB

    • memory/4512-135-0x0000000000400000-0x00000000018CF000-memory.dmp

      Filesize

      20.8MB

    • memory/4512-136-0x0000000075220000-0x00000000759D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4512-137-0x0000000006210000-0x0000000006220000-memory.dmp

      Filesize

      64KB

    • memory/4512-139-0x0000000006220000-0x00000000067C4000-memory.dmp

      Filesize

      5.6MB

    • memory/4512-138-0x0000000006210000-0x0000000006220000-memory.dmp

      Filesize

      64KB

    • memory/4512-140-0x00000000067D0000-0x0000000006DE8000-memory.dmp

      Filesize

      6.1MB

    • memory/4512-142-0x0000000006DF0000-0x0000000006EFA000-memory.dmp

      Filesize

      1.0MB

    • memory/4512-143-0x0000000006F20000-0x0000000006F32000-memory.dmp

      Filesize

      72KB

    • memory/4512-141-0x0000000000400000-0x00000000018CF000-memory.dmp

      Filesize

      20.8MB

    • memory/4512-144-0x0000000006F40000-0x0000000006F7C000-memory.dmp

      Filesize

      240KB

    • memory/4512-145-0x0000000003630000-0x0000000003659000-memory.dmp

      Filesize

      164KB

    • memory/4512-146-0x0000000003660000-0x000000000369F000-memory.dmp

      Filesize

      252KB

    • memory/4512-147-0x0000000075220000-0x00000000759D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4512-148-0x0000000006210000-0x0000000006220000-memory.dmp

      Filesize

      64KB

    • memory/4512-149-0x0000000007140000-0x00000000071B6000-memory.dmp

      Filesize

      472KB

    • memory/4512-150-0x00000000071C0000-0x0000000007252000-memory.dmp

      Filesize

      584KB

    • memory/4512-151-0x0000000007360000-0x00000000073C6000-memory.dmp

      Filesize

      408KB

    • memory/4512-153-0x0000000008700000-0x00000000088C2000-memory.dmp

      Filesize

      1.8MB

    • memory/4512-154-0x0000000008B50000-0x000000000907C000-memory.dmp

      Filesize

      5.2MB

    • memory/4512-155-0x0000000007F10000-0x0000000007F60000-memory.dmp

      Filesize

      320KB

    • memory/4512-157-0x0000000000400000-0x00000000018CF000-memory.dmp

      Filesize

      20.8MB

    • memory/4512-158-0x0000000075220000-0x00000000759D0000-memory.dmp

      Filesize

      7.7MB