Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    20/11/2021, 08:01

General

  • Target

    0143357e1751b8e60ec677b45be7eb653ca8767e88647c017d0f8bb19345e6e3.exe

  • Size

    4.5MB

  • MD5

    75dcbb6e3b1c1dd085afbb3546b68ca4

  • SHA1

    4cb490c66468fe1b4c8d73509c53dd501a3de34d

  • SHA256

    0143357e1751b8e60ec677b45be7eb653ca8767e88647c017d0f8bb19345e6e3

  • SHA512

    6898ca20553d9a128d3c36248b172771d019a7206177f9742951bbc54316304be1e0862bf94a8ff3446c53d1ddb0cf827a7acf9c9585d4e4c2dc64e1e8ef8c84

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0143357e1751b8e60ec677b45be7eb653ca8767e88647c017d0f8bb19345e6e3.exe
    "C:\Users\Admin\AppData\Local\Temp\0143357e1751b8e60ec677b45be7eb653ca8767e88647c017d0f8bb19345e6e3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vinmall_da.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\vinmall_da.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of AdjustPrivilegeToken
      PID:3344
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
      2⤵
      • Executes dropped EXE
      PID:376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 800
        3⤵
        • Drops file in Windows directory
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 780
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 816
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 948
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1608
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1160
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1256
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1248
        3⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2744

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/376-166-0x0000000000400000-0x0000000002B57000-memory.dmp

          Filesize

          39.3MB

        • memory/376-165-0x0000000002B60000-0x0000000002CAA000-memory.dmp

          Filesize

          1.3MB

        • memory/376-164-0x0000000002E27000-0x0000000002E4F000-memory.dmp

          Filesize

          160KB

        • memory/3344-122-0x0000000003F30000-0x0000000003F40000-memory.dmp

          Filesize

          64KB

        • memory/3344-158-0x0000000004F30000-0x0000000004F38000-memory.dmp

          Filesize

          32KB

        • memory/3344-159-0x0000000004F30000-0x0000000004F38000-memory.dmp

          Filesize

          32KB

        • memory/3344-160-0x0000000004F30000-0x0000000004F38000-memory.dmp

          Filesize

          32KB

        • memory/3344-151-0x0000000004E70000-0x0000000004E78000-memory.dmp

          Filesize

          32KB

        • memory/3344-135-0x0000000005510000-0x0000000005518000-memory.dmp

          Filesize

          32KB

        • memory/3344-134-0x0000000005270000-0x0000000005278000-memory.dmp

          Filesize

          32KB

        • memory/3344-128-0x00000000040D0000-0x00000000040E0000-memory.dmp

          Filesize

          64KB

        • memory/3344-121-0x0000000000030000-0x0000000000033000-memory.dmp

          Filesize

          12KB