Analysis
-
max time kernel
67s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2023 03:45
Static task
static1
Behavioral task
behavioral1
Sample
e9729b3be9699e0906ce8f425dddd858.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
e9729b3be9699e0906ce8f425dddd858.exe
-
Size
432KB
-
MD5
e9729b3be9699e0906ce8f425dddd858
-
SHA1
3802442592f47f9696b71e24bcbc313b11ac3884
-
SHA256
bb4f0fcf0b94915848c24fc234bd9cb2918e155d1cb9aef074cc6fdd7e3da335
-
SHA512
06be64183b3cb6993f4a1cefe89de5ccd2784c022bb4de1b8003808bb6210857d59ba565778d7144e15b9172889f578908978a158d01c7ba0f1d16b08e9bc06b
-
SSDEEP
6144:WhRLGr8ONwsnmhOZPJkUDx9n6vNCW/aWUrTekD8Adv75O0jd9ICV+4:WhwohsnmkZPv6vN5iWEak4Ah75kCVH
Malware Config
Extracted
Family
gcleaner
C2
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Downloads MZ/PE file
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4704 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 4916 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 3320 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 4880 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 4304 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 3420 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 512 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 632 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 1084 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 1284 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 836 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 1476 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe 4392 4980 WerFault.exe e9729b3be9699e0906ce8f425dddd858.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9729b3be9699e0906ce8f425dddd858.exe"C:\Users\Admin\AppData\Local\Temp\e9729b3be9699e0906ce8f425dddd858.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 9802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 14962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 15082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 17562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 15682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 15562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 9722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4980 -ip 49801⤵