dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3

General

Target

dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe
Size

3.1MB
MD5

74ba157ae7fa23d1d3e16f25876397d9
SHA1

4b39fdb4adb148b5c36395a39d5ff22816ca1f74
SHA256

dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3
SHA512

dbc4677a1ff48eebf98f5fb43336d872f2e378b780e1a32ca5864b3de13ac225dcdcad2a679b2dbf84a981db53b1b6276fdb18e12810d9619b3301f2f66b340f
SSDEEP

49152:Wh8pOQT0/cOTfgRbP77a4usjFu1gMZAP2p+fgbYUEksH+gJYUtuuLZmp9:jT9O2T7o0Fu1W8XEfYKlmp9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
564	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Executes dropped EXE 1 IoCs

pid	Process
564	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2092	564	WerFault.exe	97
3060	564	WerFault.exe	97
1316	564	WerFault.exe	97
3852	564	WerFault.exe	97
1252	564	WerFault.exe	97
4472	564	WerFault.exe	97
4824	564	WerFault.exe	97
2556	564	WerFault.exe	97
4796	564	WerFault.exe	97
4304	564	WerFault.exe	97
1604	564	WerFault.exe	97
1632	564	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe
564	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3924	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
564	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 564	3924	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe	97
PID 3924 wrote to memory of 564	3924	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe	97
PID 3924 wrote to memory of 564	3924	dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe	97

C:\Users\Admin\AppData\Local\Temp\dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe
"C:\Users\Admin\AppData\Local\Temp\dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe
  C:\Users\Admin\AppData\Local\Temp\dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 344
    3⤵
    - Program crash
    PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 636
    3⤵
    - Program crash
    PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 684
    3⤵
    - Program crash
    PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 664
    3⤵
    - Program crash
    PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 720
    3⤵
    - Program crash
    PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 884
    3⤵
    - Program crash
    PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1440
    3⤵
    - Program crash
    PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1448
    3⤵
    - Program crash
    PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1656
    3⤵
    - Program crash
    PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1476
    3⤵
    - Program crash
    PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1692
    3⤵
    - Program crash
    PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1436
    3⤵
    - Program crash
    PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3924 -ip 3924
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 564 -ip 564
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 564 -ip 564
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 564 -ip 564
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 564 -ip 564
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 564 -ip 564
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 564 -ip 564
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 564 -ip 564
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 564 -ip 564
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 564 -ip 564
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 564 -ip 564
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 564 -ip 564
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 564 -ip 564
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dca92e5e758629c8f98a2ee446790b96974dca4980572190a0c2b151f4b3ced3.exe

Filesize
3.1MB

MD5
fd02e3d4bd55062d4e41cf99c418a285

SHA1
605f6a4b420d73c19dc8207521e2140fa5096e12

SHA256
bf1b22bbee511492ed76e17d6470e94958ac84328b641160c1c3fc0e091528d3

SHA512
de06df98f2980a1e36e90119eec0331d2cd5b93232f520041cbb5d9ef4ecd523ee9e707ffcce28a8b000b340902ff92f87aa671dea569afa755c1d6bfc82814c

Download Submit
memory/564-7-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/564-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/564-9-0x00000000050D0000-0x00000000051B4000-memory.dmp

Filesize
912KB

Download
memory/564-20-0x000000000B9F0000-0x000000000BA93000-memory.dmp

Filesize
652KB

Download
memory/564-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3924-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3924-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download

Analysis

Sharing