3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b

General

Target

3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe
Size

6.2MB
MD5

bfbb10a987825e9a15e64d0554fd7b86
SHA1

8e3775701774d40ffd1495d25c5c0cb7d2402a22
SHA256

3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b
SHA512

c4eb63b8e803f8bae53d239bb531d85caa442bb5d724d2fdb45fdf1b2e3604fe849b5f0adfd01e923698575ff57c9f99de7f3181eced9f96fb678fd49c0d157b
SSDEEP

98304:8rWyJGT7o0Fu1W8XEfYKlmpYzPouT7o0Fu1W8XEfYd:IW6GT8EfWyQuT8Efy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
564	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Executes dropped EXE 1 IoCs

pid	Process
564	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4652	564	WerFault.exe	96
2764	564	WerFault.exe	96
1844	564	WerFault.exe	96
1480	564	WerFault.exe	96
920	564	WerFault.exe	96
3760	564	WerFault.exe	96
2800	564	WerFault.exe	96
2980	564	WerFault.exe	96
2312	564	WerFault.exe	96
4472	564	WerFault.exe	96
1480	564	WerFault.exe	96
3656	564	WerFault.exe	96
4800	564	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe
564	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4868	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
564	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 564	4868	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe	96
PID 4868 wrote to memory of 564	4868	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe	96
PID 4868 wrote to memory of 564	4868	3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe	96

C:\Users\Admin\AppData\Local\Temp\3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe
"C:\Users\Admin\AppData\Local\Temp\3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe
  C:\Users\Admin\AppData\Local\Temp\3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 344
    3⤵
    - Program crash
    PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 636
    3⤵
    - Program crash
    PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 628
    3⤵
    - Program crash
    PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 628
    3⤵
    - Program crash
    PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 720
    3⤵
    - Program crash
    PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 888
    3⤵
    - Program crash
    PID:3760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1404
    3⤵
    - Program crash
    PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1492
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1504
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1516
    3⤵
    - Program crash
    PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1664
    3⤵
    - Program crash
    PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1524
    3⤵
    - Program crash
    PID:3656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1548
    3⤵
    - Program crash
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4868 -ip 4868
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 564 -ip 564
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 564 -ip 564
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 564 -ip 564
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 564 -ip 564
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 564 -ip 564
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 564 -ip 564
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 564 -ip 564
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 564 -ip 564
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 564 -ip 564
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 564 -ip 564
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 564 -ip 564
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 564 -ip 564
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 564 -ip 564
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ed087d3987096d19ceb13b66ad0792ad46fe71e717a7e1db05ac7de2cf4831b.exe

Filesize
6.2MB

MD5
c07833c33a814361bb7ec59b56e77914

SHA1
b29748e32b9f8b418e8caeeadd404a0014420bef

SHA256
f95a9bdedef8ce678f75929c0d22982f6e0262d2904e1c9da90c9d17c4eb1efa

SHA512
5d9756e26998bc5d04cf0a5a2d34a254024d1861e0d0f221bd2a897ff0e51afc10cc60f5f812f30275a8dfcaffeba7ac274dddf5d5a2ef2fbdfd0107b5904c66

Download Submit
memory/564-7-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/564-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/564-9-0x0000000005030000-0x0000000005114000-memory.dmp

Filesize
912KB

Download
memory/564-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/564-27-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download
memory/4868-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4868-6-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download

Analysis

Sharing