Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
utweb_installer.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
utweb_installer.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
utweb_installer.exe
-
Size
12.4MB
-
MD5
aa6ba9e8041dcef9d5b1dbaa1fb41570
-
SHA1
8244de9d8b89058d1c03f0d5a42e276227574159
-
SHA256
e482863957a81bf585e637311d51be7a4cb8819d432ce5dab3b089ceb46005b5
-
SHA512
24fabd8186b2b327b057a19f86c4e74bd57e0e807eb01a7b727d27a610e8e8ceeeb2827fe32b722e7f1a468a02535f026f00e484ff40c38c724db9e1e480b2a6
-
SSDEEP
3072:3qhbDcxipV57ihAgGHQhOxg4GUHmEOW2zOyQ5OGXubV0EYH9QJSp8Bb8EGq:SncxipAASq1mv/S5DXubV0EYk8EG
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2752 1680 WerFault.exe utweb_installer.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
utweb_installer.exedescription pid process target process PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe PID 1680 wrote to memory of 2752 1680 utweb_installer.exe WerFault.exe