Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:21
Static task
static1
Behavioral task
behavioral1
Sample
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe
Resource
win10v2004-20221111-en
General
-
Target
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe
-
Size
1.8MB
-
MD5
99ba50fea2e8f47619b77ec74d562e1c
-
SHA1
017d72654d254f46de346efaad0a9b0937f38a60
-
SHA256
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
-
SHA512
5f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
SSDEEP
49152:RvpZYsaHqe9AQhlPiTPi/3OQBipYI46GUA:RvpZuqe9AQhlPiTPi/3OQBipYI46GUA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
windll.exepid process 956 windll.exe -
Loads dropped DLL 5 IoCs
Processes:
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exeWerFault.exepid process 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exewindll.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Processor = "C:\\Users\\Admin\\AppData\\Roaming\\updater\\windll.exe" 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Processor = "C:\\Users\\Admin\\AppData\\Roaming\\updater\\windll.exe" windll.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1288 956 WerFault.exe windll.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exewindll.exedescription pid process target process PID 1168 wrote to memory of 956 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe windll.exe PID 1168 wrote to memory of 956 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe windll.exe PID 1168 wrote to memory of 956 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe windll.exe PID 1168 wrote to memory of 956 1168 9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe windll.exe PID 956 wrote to memory of 1288 956 windll.exe WerFault.exe PID 956 wrote to memory of 1288 956 windll.exe WerFault.exe PID 956 wrote to memory of 1288 956 windll.exe WerFault.exe PID 956 wrote to memory of 1288 956 windll.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe"C:\Users\Admin\AppData\Local\Temp\9fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\updater\windll.exe"C:\Users\Admin\AppData\Roaming\updater\windll.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 1643⤵
- Loads dropped DLL
- Program crash
PID:1288
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
\Users\Admin\AppData\Roaming\updater\windll.exeFilesize
1.8MB
MD599ba50fea2e8f47619b77ec74d562e1c
SHA1017d72654d254f46de346efaad0a9b0937f38a60
SHA2569fda75c77ed5e6d8f673aa4c1582d5497dd9f8958199e28997b0f3befaf4b625
SHA5125f52e07673adbd6132c05873266c3a25770387bdb64e5a8452f7acea526e1b6809e50ba62522f07b98bcfe1a9942c3b52eeb14688d6391e2f61fb6cd31a2bcad
-
memory/956-57-0x0000000000000000-mapping.dmp
-
memory/956-63-0x0000000000400000-0x0000000000653000-memory.dmpFilesize
2.3MB
-
memory/1168-54-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1288-60-0x0000000000000000-mapping.dmp