dcdf6845df1e1aed6f335dd6f2a3ff7351984522235937e5c4a1c746c7fe4371

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2022 14:04

Target

C4Loader.exe
Size

451KB
MD5

6ebfb1bc4aef4886d38fbb5170371b58
SHA1

084b3f0910c3fcf8a4cfeed2428ff786b94f3759
SHA256

dcdf6845df1e1aed6f335dd6f2a3ff7351984522235937e5c4a1c746c7fe4371
SHA512

c041161a616de51ebe98e01c93e710ccf177a52f998376808b56e6e624c40729377298335fde0092b2472af3acd8e9b417701f23c4afc24053e837f17346300a
SSDEEP

6144:aO6T/AiMhIbmjE1RrkHDS83avj7hPBV8MvqndNrhuCJm/rGlnrxZOc:cT/yIKjE1RrkHDS83aHTehuCJwGlnXJ

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

C4Loader.exe

description pid process target process

PID 1048 set thread context of 4896 1048 C4Loader.exe vbc.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

64 4896 WerFault.exe vbc.exe
1564 1048 WerFault.exe C4Loader.exe

description	pid	process	target process
PID 1048 set thread context of 4896	1048	C4Loader.exe	vbc.exe

pid	pid_target	process	target process
64	4896	WerFault.exe	vbc.exe
1564	1048	WerFault.exe	C4Loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

C4Loader.exe

description	pid	process	target process
PID 1048 wrote to memory of 4896	1048	C4Loader.exe	vbc.exe
PID 1048 wrote to memory of 4896	1048	C4Loader.exe	vbc.exe
PID 1048 wrote to memory of 4896	1048	C4Loader.exe	vbc.exe
PID 1048 wrote to memory of 4896	1048	C4Loader.exe	vbc.exe
PID 1048 wrote to memory of 4896	1048	C4Loader.exe	vbc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 12
3⤵
- Program crash
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 272
2⤵
- Program crash
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1048 -ip 1048
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4896 -ip 4896
1⤵
PID:3188

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/4896-132-0x0000000000000000-mapping.dmp

Download
memory/4896-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download