50956c28d06ae321e79482964bce864bb07c552241017cb152a69c8078fea18c

General

Target

9e026042beea2469af4b31301fe94a72.exe
Size

2.0MB
MD5

9e026042beea2469af4b31301fe94a72
SHA1

7363a0224c9d4498952cbd8c122f7729837e2bbb
SHA256

50956c28d06ae321e79482964bce864bb07c552241017cb152a69c8078fea18c
SHA512

e28861396f6d0f274fbad21ca382dc0a7b039a3a5370f1cc12ef12b61d6b7f2561bd45535666c225f1b368542d0815ffe4abbfa9a6b5c732760234d4e948a690
SSDEEP

49152:2Syg4ubqAus098gygLHgpoQnB+UU6agyg:UgVMsk8oQnfU

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4792	9e026042beea2469af4b31301fe94a72.exe

Executes dropped EXE 1 IoCs

pid	Process
4792	9e026042beea2469af4b31301fe94a72.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2344	464	WerFault.exe	87
1732	4792	WerFault.exe	95
2988	4792	WerFault.exe	95
908	4792	WerFault.exe	95
364	4792	WerFault.exe	95
2124	4792	WerFault.exe	95
1856	4792	WerFault.exe	95
1620	4792	WerFault.exe	95
3640	4792	WerFault.exe	95
2528	4792	WerFault.exe	95
4912	4792	WerFault.exe	95
3616	4792	WerFault.exe	95
1488	4792	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	9e026042beea2469af4b31301fe94a72.exe
4792	9e026042beea2469af4b31301fe94a72.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
464	9e026042beea2469af4b31301fe94a72.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4792	9e026042beea2469af4b31301fe94a72.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4792	464	9e026042beea2469af4b31301fe94a72.exe	95
PID 464 wrote to memory of 4792	464	9e026042beea2469af4b31301fe94a72.exe	95
PID 464 wrote to memory of 4792	464	9e026042beea2469af4b31301fe94a72.exe	95

C:\Users\Admin\AppData\Local\Temp\9e026042beea2469af4b31301fe94a72.exe
"C:\Users\Admin\AppData\Local\Temp\9e026042beea2469af4b31301fe94a72.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 344
  2⤵
  - Program crash
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\9e026042beea2469af4b31301fe94a72.exe
  C:\Users\Admin\AppData\Local\Temp\9e026042beea2469af4b31301fe94a72.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 344
    3⤵
    - Program crash
    PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 636
    3⤵
    - Program crash
    PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 652
    3⤵
    - Program crash
    PID:908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 664
    3⤵
    - Program crash
    PID:364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 720
    3⤵
    - Program crash
    PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 904
    3⤵
    - Program crash
    PID:1856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1396
    3⤵
    - Program crash
    PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1440
    3⤵
    - Program crash
    PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1492
    3⤵
    - Program crash
    PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1516
    3⤵
    - Program crash
    PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1664
    3⤵
    - Program crash
    PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1684
    3⤵
    - Program crash
    PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 464 -ip 464
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4792 -ip 4792
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4792 -ip 4792
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4792 -ip 4792
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 4792
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 4792
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4792 -ip 4792
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4792 -ip 4792
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4792 -ip 4792
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9e026042beea2469af4b31301fe94a72.exe

Filesize
1.2MB

MD5
af2492d83d3ad4b6d71c6ed69b4804f2

SHA1
48137291556bc1bff2987331226ab668e2d055fa

SHA256
1f5c86c21c23b605b71bfbaaf591b50f60f07b6e9b1b31e93b90c0d74cd31b6b

SHA512
911d37d9c1712c200371ac79122cd77bd5e55682082752cc8929dfec9731c3df24b8bfa5b0c4bc7fe0df9d0b881b28883be84732a4ba89b41b513e48d226bfff

Download Submit
memory/464-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/464-6-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4792-7-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4792-8-0x0000000004FA0000-0x00000000050AD000-memory.dmp

Filesize
1.1MB

Download
memory/4792-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4792-19-0x000000000B9D0000-0x000000000BA73000-memory.dmp

Filesize
652KB

Download
memory/4792-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing