Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 10:35

General

  • Target

    1613ac9bee0f9eee44a174a429e00304.exe

  • Size

    315KB

  • MD5

    1613ac9bee0f9eee44a174a429e00304

  • SHA1

    06f383aef113d55f8cecc783a3201672cb665b67

  • SHA256

    739d8e1827427be96252e8d9da08ca56f6d0bb16d8b8363c38b17f6adac38801

  • SHA512

    66d7f6f8f904158624161e114d20f07d2c0d36280c4dea9414661fe6e0ce6ddbb494438751c7c8fb65dab60231a01cd8cea91e1244dd4bbe44481aee50ce536f

  • SSDEEP

    6144:ipyMDh0f0a4WJGDcoTZAdtqs/TcmrfhIpBfCCRDeV/w2AptN0caMOwXzzQI:erDef0pJXTZAtp/HfhIpdXDefuN0cnRs

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Program crash 1 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1613ac9bee0f9eee44a174a429e00304.exe
    "C:\Users\Admin\AppData\Local\Temp\1613ac9bee0f9eee44a174a429e00304.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 388
      2⤵
      • Program crash
      PID:3624
    • C:\Windows\SysWOW64\net.exe
      net stop SharedAccess
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop SharedAccess
        3⤵
          PID:3788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
      1⤵
        PID:2988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5048-0-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-2-0x0000000000620000-0x0000000000667000-memory.dmp

        Filesize

        284KB

      • memory/5048-3-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-7-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-8-0x00000000005F0000-0x00000000005FC000-memory.dmp

        Filesize

        48KB

      • memory/5048-9-0x00000000022E0000-0x000000000234E000-memory.dmp

        Filesize

        440KB

      • memory/5048-10-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-11-0x00000000023A0000-0x00000000023A1000-memory.dmp

        Filesize

        4KB

      • memory/5048-12-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-13-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-14-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-16-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-17-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-19-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/5048-20-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB