Analysis
-
max time kernel
113s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2023 14:42
Static task
static1
Behavioral task
behavioral1
Sample
99a3cebe3450021c771985d2414bfcae.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
99a3cebe3450021c771985d2414bfcae.exe
-
Size
260KB
-
MD5
99a3cebe3450021c771985d2414bfcae
-
SHA1
d0a5583d0ec903418fc1f8043f005824b11a6fdb
-
SHA256
0df707ea4faac4b07939ac3a4cc235699451830cfb75f6d665a2a81f0bc125e6
-
SHA512
d82d76d0cd5a8705c8122613920c82c7e7ff864159d3559ae9a0b4e4452ba72b11d78b935a60373c3b9bdafc14ec57dad1b423c7340085ae5bab443319560e91
-
SSDEEP
6144:kAYTwA8lsnpt1cuXdgn87eFsLniXf2LQaRgyXET:p0HmsnjXSn87eFsjtLQ0gms
Malware Config
Extracted
Family
gcleaner
C2
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4296 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 4388 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 1352 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 4752 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 2428 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 1300 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 100 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe 5092 1996 WerFault.exe 99a3cebe3450021c771985d2414bfcae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a3cebe3450021c771985d2414bfcae.exe"C:\Users\Admin\AppData\Local\Temp\99a3cebe3450021c771985d2414bfcae.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 8482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 9802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 13162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 12002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1996 -ip 19961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1996-134-0x00000000021E0000-0x0000000002220000-memory.dmpFilesize
256KB
-
memory/1996-135-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1996-136-0x00000000021E0000-0x0000000002220000-memory.dmpFilesize
256KB
-
memory/1996-140-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB