Analysis
-
max time kernel
1378s -
max time network
1382s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-06-2022 17:27
Static task
static1
Behavioral task
behavioral1
Sample
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe
Resource
win7-20220414-en
General
-
Target
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe
-
Size
332KB
-
MD5
cf547bf62ab1d3bf361ddf6dcd59c55f
-
SHA1
8737abef83971f23e1a2d2c304e997b39073e4fd
-
SHA256
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed
-
SHA512
239513eb00107785dd7165170832aed7ccdebedd0464d74db800af95a3aa52ef0bc84e4e201221f98dc8a142d25da283dca19fe84376499998e037f320d668d1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exepid process 1912 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Processes:
resource yara_rule behavioral1/memory/304-69-0x0000000000400000-0x0000000000583000-memory.dmp upx -
Loads dropped DLL 9 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exeWerFault.exepid process 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 1348 WerFault.exe 1348 WerFault.exe 1348 WerFault.exe 1348 WerFault.exe 1348 WerFault.exe 1348 WerFault.exe 1348 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1348 1912 WerFault.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exepid process 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription pid process target process PID 304 wrote to memory of 1912 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 304 wrote to memory of 1912 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 304 wrote to memory of 1912 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 304 wrote to memory of 1912 304 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 1912 wrote to memory of 1348 1912 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WerFault.exe PID 1912 wrote to memory of 1348 1912 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WerFault.exe PID 1912 wrote to memory of 1348 1912 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WerFault.exe PID 1912 wrote to memory of 1348 1912 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe"C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeC:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1003⤵
- Loads dropped DLL
- Program crash
PID:1348
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
memory/304-67-0x0000000075311000-0x0000000075313000-memory.dmpFilesize
8KB
-
memory/304-69-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/304-70-0x0000000000360000-0x00000000003B1000-memory.dmpFilesize
324KB
-
memory/1348-60-0x0000000000000000-mapping.dmp
-
memory/1912-56-0x0000000000000000-mapping.dmp
-
memory/1912-71-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB