47a01bde203f4226ec4a070d4a91bd5c465f9c674041d3d03aa59315f10d9fd9

General

Target

119e19358c019cebcbfc34362377f3c3.exe
Size

3.9MB
MD5

119e19358c019cebcbfc34362377f3c3
SHA1

9e0c89e543e001e2b3af3026157cf0a4cd16efc5
SHA256

47a01bde203f4226ec4a070d4a91bd5c465f9c674041d3d03aa59315f10d9fd9
SHA512

0872823e431f6d10d8d6088cd26b272749448261467e4da86399f3e881dfde9709a46e138c761a0379b2c2c97ca40006dd9a80a9141ba2e2e60a6b4b8f5bb39c
SSDEEP

49152:a0Ir+hgwb3sQg2ebaBKmGZc7gwbIh2/metNFT8g9qgwb3sQg2ebaBKmGZc7gwb1:aNyFb+2kqV5F/metNSBb+2kqV5h

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3652	119e19358c019cebcbfc34362377f3c3.exe

Executes dropped EXE 1 IoCs

pid	Process
3652	119e19358c019cebcbfc34362377f3c3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 14 IoCs

pid	pid_target	Process	procid_target
4040	3144	WerFault.exe	87
468	3652	WerFault.exe	98
2100	3652	WerFault.exe	98
3988	3652	WerFault.exe	98
720	3652	WerFault.exe	98
4236	3652	WerFault.exe	98
3740	3652	WerFault.exe	98
3584	3652	WerFault.exe	98
2452	3652	WerFault.exe	98
4800	3652	WerFault.exe	98
2240	3652	WerFault.exe	98
3304	3652	WerFault.exe	98
2016	3652	WerFault.exe	98
4808	3652	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3652	119e19358c019cebcbfc34362377f3c3.exe
3652	119e19358c019cebcbfc34362377f3c3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3144	119e19358c019cebcbfc34362377f3c3.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3652	119e19358c019cebcbfc34362377f3c3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3652	3144	119e19358c019cebcbfc34362377f3c3.exe	98
PID 3144 wrote to memory of 3652	3144	119e19358c019cebcbfc34362377f3c3.exe	98
PID 3144 wrote to memory of 3652	3144	119e19358c019cebcbfc34362377f3c3.exe	98

C:\Users\Admin\AppData\Local\Temp\119e19358c019cebcbfc34362377f3c3.exe
"C:\Users\Admin\AppData\Local\Temp\119e19358c019cebcbfc34362377f3c3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 352
  2⤵
  - Program crash
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\119e19358c019cebcbfc34362377f3c3.exe
  C:\Users\Admin\AppData\Local\Temp\119e19358c019cebcbfc34362377f3c3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 352
    3⤵
    - Program crash
    PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 628
    3⤵
    - Program crash
    PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 636
    3⤵
    - Program crash
    PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 636
    3⤵
    - Program crash
    PID:720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 728
    3⤵
    - Program crash
    PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 924
    3⤵
    - Program crash
    PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1396
    3⤵
    - Program crash
    PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1464
    3⤵
    - Program crash
    PID:2452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1480
    3⤵
    - Program crash
    PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1484
    3⤵
    - Program crash
    PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1672
    3⤵
    - Program crash
    PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1508
    3⤵
    - Program crash
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1536
    3⤵
    - Program crash
    PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3144 -ip 3144
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3652 -ip 3652
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3652 -ip 3652
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3652 -ip 3652
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3652 -ip 3652
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3652 -ip 3652
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3652 -ip 3652
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3652 -ip 3652
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3652 -ip 3652
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3652 -ip 3652
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3652 -ip 3652
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3652 -ip 3652
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3652 -ip 3652
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3652 -ip 3652
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\119e19358c019cebcbfc34362377f3c3.exe

Filesize
3.9MB

MD5
e7d8a429236c62f0fe8129d58341c715

SHA1
2c1ed6520607be51bf0cc6943a1fa09ac743e083

SHA256
d2e07c67c4a87a82f7579ec365dce72ad3c24738be35066d8022844fed227aeb

SHA512
6a557edf5b77125af4337b9ab730328cf7c302ef5f5eda02c3e7d270cb45d7af80275b21726f6cc1b8c94aa11f190d01b04f6ee913b79b86edf7fa8b24d94144

Download Submit
memory/3144-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3144-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3144-9-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3652-10-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3652-11-0x00000000050E0000-0x00000000051C5000-memory.dmp

Filesize
916KB

Download
memory/3652-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3652-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3652-27-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download

Analysis

Sharing