Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
3c3156de49276bfcb908126759ea0f7e.exe
Resource
win7-20231215-en
General
-
Target
3c3156de49276bfcb908126759ea0f7e.exe
-
Size
1.1MB
-
MD5
3c3156de49276bfcb908126759ea0f7e
-
SHA1
3b580fa227336f11512e592c99040db279352e92
-
SHA256
960a8b99ffcc13827dbf38256c81cf5b8a37e4308b526713445080d2b096fbc0
-
SHA512
429ea2f4bd883144f730223e97085ab2dd646155efb668e446f836337937b9af1c2532ba4b04ce43040b9fbf2f4fe1c68c28fdc4c0b9ba300a396fed79e497b1
-
SSDEEP
24576:3Ia4wNu3SaZYo+51mnW0Lj7oBj3bqoWVomcqBoG:351uCr10j7oBj3mLVlcqBo
Malware Config
Extracted
arkei
185.241.52.252/qRdXmPWvrh.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c3156de49276bfcb908126759ea0f7e.exedescription pid process target process PID 2516 set thread context of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2252 2808 WerFault.exe 3c3156de49276bfcb908126759ea0f7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3c3156de49276bfcb908126759ea0f7e.exedescription pid process Token: SeDebugPrivilege 2516 3c3156de49276bfcb908126759ea0f7e.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3c3156de49276bfcb908126759ea0f7e.exe3c3156de49276bfcb908126759ea0f7e.exedescription pid process target process PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2516 wrote to memory of 2808 2516 3c3156de49276bfcb908126759ea0f7e.exe 3c3156de49276bfcb908126759ea0f7e.exe PID 2808 wrote to memory of 2252 2808 3c3156de49276bfcb908126759ea0f7e.exe WerFault.exe PID 2808 wrote to memory of 2252 2808 3c3156de49276bfcb908126759ea0f7e.exe WerFault.exe PID 2808 wrote to memory of 2252 2808 3c3156de49276bfcb908126759ea0f7e.exe WerFault.exe PID 2808 wrote to memory of 2252 2808 3c3156de49276bfcb908126759ea0f7e.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3156de49276bfcb908126759ea0f7e.exe"C:\Users\Admin\AppData\Local\Temp\3c3156de49276bfcb908126759ea0f7e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c3156de49276bfcb908126759ea0f7e.exe"C:\Users\Admin\AppData\Local\Temp\3c3156de49276bfcb908126759ea0f7e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 6523⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2516-21-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2516-4-0x0000000000760000-0x0000000000778000-memory.dmpFilesize
96KB
-
memory/2516-1-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2516-2-0x0000000002310000-0x0000000002350000-memory.dmpFilesize
256KB
-
memory/2516-0-0x0000000000030000-0x0000000000148000-memory.dmpFilesize
1.1MB
-
memory/2516-5-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2516-6-0x0000000002310000-0x0000000002350000-memory.dmpFilesize
256KB
-
memory/2516-7-0x0000000006370000-0x00000000063E6000-memory.dmpFilesize
472KB
-
memory/2516-8-0x0000000008460000-0x00000000084EC000-memory.dmpFilesize
560KB
-
memory/2516-9-0x0000000002060000-0x000000000207C000-memory.dmpFilesize
112KB
-
memory/2516-3-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2808-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-13-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-10-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-20-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-19-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-17-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2808-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2808-22-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB