Overview

overview

8

Static

static

f678aec1f5...1d.exe

windows7-x64

8

f678aec1f5...1d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe

  • Size

    275KB

  • MD5

    f308b84f9d86603a6da062a2bdb39cac

  • SHA1

    fbeffa677d5793b4aed63f0e24b83956b432e265

  • SHA256

    f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d

  • SHA512

    348cbcc3aad5f3deed87a53bbcc6586c244a0a87d0a205f68d6b41b9ee9380012a7ca51c094c8407de554b50aea85a834553ae18a1ffb8a41f0ae7a1034621ff

  • SSDEEP

    6144:S2udwvUa65YC816HzafM3rcsqsqshvX5giNZ:Zudw/6H13resqEKiNZ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
    "C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 376
      2⤵
      • Program crash
      PID:4532
    • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
      C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:4756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 344
        3⤵
        • Program crash
        PID:2288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 636
        3⤵
        • Program crash
        PID:3628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 724
        3⤵
        • Program crash
        PID:4896
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 728
        3⤵
        • Program crash
        PID:1480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 984
        3⤵
        • Program crash
        PID:996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 976
        3⤵
        • Program crash
        PID:3196
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3328 -ip 3328
    1⤵
      PID:2744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4756 -ip 4756
      1⤵
        PID:4824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4756 -ip 4756
        1⤵
          PID:2784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4756 -ip 4756
          1⤵
            PID:1268
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4756 -ip 4756
            1⤵
              PID:2280
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4756 -ip 4756
              1⤵
                PID:4724
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4756 -ip 4756
                1⤵
                  PID:3104

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
                  Filesize

                  275KB

                  MD5

                  7ddfaa97ee666a06bfc66cb49128e129

                  SHA1

                  8f1c2fdf26a806c2495bcd3d2d39ded89ea1449a

                  SHA256

                  e7fa8765905bac9736f719c886841e9c22c98f158628445fc3a5423a69494096

                  SHA512

                  a0a230baebcd11a1f1e46614878e52d293742fb176a076959cdc535288bb79b865b9350b4848c7061e72ddbedf82442b8fb336338a14023f9e670cf03002406b

                  Download Submit

                • memory/3328-132-0x0000000000400000-0x000000000044D000-memory.dmp

                  Filesize

                  308KB

                  Download

                • memory/3328-135-0x0000000000400000-0x000000000044D000-memory.dmp

                  Filesize

                  308KB

                  Download

                • memory/4756-138-0x0000000004D70000-0x0000000004DBD000-memory.dmp

                  Filesize

                  308KB

                  Download

                • memory/4756-139-0x0000000000400000-0x000000000044D000-memory.dmp

                  Filesize

                  308KB

                  Download

                • memory/4756-140-0x0000000000400000-0x000000000044D000-memory.dmp

                  Filesize

                  308KB

                  Download