286f4f8d0bc1b2645d25f1d0718a30323403e4f26dea4c5dbc70f43a0d33a0c0 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 22:33

Sharing

Report Analysis Logs

General

Target

Maya Password Stealer/stub.exe
Size

126KB
MD5

f59060c2c85abd00b4462405b0b2a462
SHA1

be4498318f462b3d60234dce892bac86b90630e0
SHA256

a5e91d4ce12c2c8ff1a1424bfe0ea595d287160bfbd156c3e4ab88c8a73ae4a4
SHA512

0cf1ce0c5f82400dc81296b9a31863401f3ee646462d47f16d76f297b9fa0abeb81a4bfd1afb625c668460d05aa7378721c296a0470bf309d7b85c67b728fcdc
SSDEEP

3072:W/2WB/21SxNLLcLktrtR+Rw180HxAZKbh7Y9xJ:q/QSxNLLttR+Rw2Ky9x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3068 2904 WerFault.exe stub.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

stub.exe

description	pid	process	target process
PID 2904 wrote to memory of 3068	2904	stub.exe	WerFault.exe
PID 2904 wrote to memory of 3068	2904	stub.exe	WerFault.exe
PID 2904 wrote to memory of 3068	2904	stub.exe	WerFault.exe
PID 2904 wrote to memory of 3068	2904	stub.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Maya Password Stealer\stub.exe
"C:\Users\Admin\AppData\Local\Temp\Maya Password Stealer\stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 152
2⤵
- Program crash
PID:3068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-7-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2904-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2904-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download