bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde

General

Target

bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe
Size

1012KB
MD5

0ed786f9b0138cc2f7c61c679d962add
SHA1

e15dea61b354a2d1328ee01bd2277072469ed4dd
SHA256

bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde
SHA512

47438edf9396f2a4ed56a91fa846f782659ba921173f90d66ded02bdd636f66dd4b570c79f7c1110e870b9a6d8ec692bde8819215b5bdae891a859d17fa8bfa7
SSDEEP

24576:vphKVC+tUnlrsj30zKdMWkSUra/ZSX77Lv+f6T8E:R+unBsjIKdMVSWgQbD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2860	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2724	5024	WerFault.exe	84
3144	2860	WerFault.exe	96
3732	2860	WerFault.exe	96
2168	2860	WerFault.exe	96
2804	2860	WerFault.exe	96
1796	2860	WerFault.exe	96
2852	2860	WerFault.exe	96
3380	2860	WerFault.exe	96
3176	2860	WerFault.exe	96
1212	2860	WerFault.exe	96
4632	2860	WerFault.exe	96
1180	2860	WerFault.exe	96
2224	2860	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe
2860	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5024	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2860	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2860	5024	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe	96
PID 5024 wrote to memory of 2860	5024	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe	96
PID 5024 wrote to memory of 2860	5024	bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe	96

C:\Users\Admin\AppData\Local\Temp\bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe
"C:\Users\Admin\AppData\Local\Temp\bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 344
  2⤵
  - Program crash
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe
  C:\Users\Admin\AppData\Local\Temp\bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 344
    3⤵
    - Program crash
    PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 628
    3⤵
    - Program crash
    PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 628
    3⤵
    - Program crash
    PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 628
    3⤵
    - Program crash
    PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 740
    3⤵
    - Program crash
    PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 900
    3⤵
    - Program crash
    PID:2852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1400
    3⤵
    - Program crash
    PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1444
    3⤵
    - Program crash
    PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1468
    3⤵
    - Program crash
    PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1512
    3⤵
    - Program crash
    PID:4632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1536
    3⤵
    - Program crash
    PID:1180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 632
    3⤵
    - Program crash
    PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2860 -ip 2860
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2860 -ip 2860
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2860 -ip 2860
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2860 -ip 2860
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2860 -ip 2860
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2860 -ip 2860
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2860 -ip 2860
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2860 -ip 2860
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2860 -ip 2860
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2860 -ip 2860
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2860 -ip 2860
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2860 -ip 2860
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bc369e4edfaec4297695b3cd8b91d49e55ae445b6e93fa4b89a7b3e91ea47cde.exe

Filesize
1012KB

MD5
7a813b157b4e2642a320a27ac3c921b9

SHA1
4fc944519f6a7c2e87bfe653da80fc01e6f722f0

SHA256
f3f1c8269c53bbdf336641926328bc048114ffe15501c87628bab95f62dafecd

SHA512
dab7fea06668bfbe1830f13de5913ce7f8ef71549fe5d0a7e4cdb29f4a9bc3acab57c51b845b1756b53ffcde1128972a76b2ac415f8136b349c00c15ffacfb57

Download Submit
memory/2860-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2860-8-0x0000000005110000-0x00000000051F5000-memory.dmp

Filesize
916KB

Download
memory/2860-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2860-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2860-21-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download
memory/5024-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/5024-6-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download

Analysis

Sharing