f17169b0899deeded527fc3844abf46b7f14af1643568fcd95c04a69205282b6

Analysis

max time kernel
67s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 15:45

Target

C4Loader.exe
Size

1023KB
MD5

58085125085deb901f7a9dc84878dc83
SHA1

4449658339d5ac9b6548547d4796a91d3e4988fd
SHA256

f17169b0899deeded527fc3844abf46b7f14af1643568fcd95c04a69205282b6
SHA512

5b05bc767d56f71305b8695dec76a9d14d7d70c703bfa5426ec5e40238a6c54bb570e752ed060aba09064f70792bc936150304ed3e9fcc86ada54cb6c2e8ee2a
SSDEEP

3072:sb+Ukz9+SIRWDWTZjBIEIqjs6MsYkkblHz54uAg0FujDQ/Sv3x+F1I02:satETNjKEI4IsZkjAOsiB+F1I/

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

C4Loader.exe

description pid process target process

PID 2440 set thread context of 3580 2440 C4Loader.exe vbc.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1952 2440 WerFault.exe C4Loader.exe
2636 3580 WerFault.exe vbc.exe

description	pid	process	target process
PID 2440 set thread context of 3580	2440	C4Loader.exe	vbc.exe

pid	pid_target	process	target process
1952	2440	WerFault.exe	C4Loader.exe
2636	3580	WerFault.exe	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

C4Loader.exe

description	pid	process	target process
PID 2440 wrote to memory of 3580	2440	C4Loader.exe	vbc.exe
PID 2440 wrote to memory of 3580	2440	C4Loader.exe	vbc.exe
PID 2440 wrote to memory of 3580	2440	C4Loader.exe	vbc.exe
PID 2440 wrote to memory of 3580	2440	C4Loader.exe	vbc.exe
PID 2440 wrote to memory of 3580	2440	C4Loader.exe	vbc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 16
3⤵
- Program crash
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 264
2⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2440 -ip 2440
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3580 -ip 3580
1⤵
PID:4508

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2440-139-0x0000000000770000-0x0000000000874000-memory.dmp

Filesize
1.0MB

Download
memory/2440-140-0x0000000000770000-0x0000000000874000-memory.dmp

Filesize
1.0MB

Download
memory/3580-132-0x0000000000000000-mapping.dmp

Download
memory/3580-133-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download