e5eb6a056250b15f61e77f7d27662316c832dee1bfd6493630f72f726b70503a

General

Target

52809efae9ec20e09e8a1aa35e1af1a5.exe
Size

4.0MB
MD5

52809efae9ec20e09e8a1aa35e1af1a5
SHA1

26827af0092c2a377cd1566698dbfac464bac48b
SHA256

e5eb6a056250b15f61e77f7d27662316c832dee1bfd6493630f72f726b70503a
SHA512

8ee121294efba1513054ebdff4bc866e8daa6520498c00a8c91b853f254c978ba4ad9b8d7676848e90ed04316c2683823a53756531414a749b03b97e9337d870
SSDEEP

49152:XGPjEhnqWQ5fYZeK93ghbq4TTow+lsghbyV8qXdTt/P9afxiMghbq4TTow+lsghH:WPkFIIohTWROV8qtx9aYhTWRH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1764	52809efae9ec20e09e8a1aa35e1af1a5.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	52809efae9ec20e09e8a1aa35e1af1a5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 14 IoCs

pid	pid_target	Process	procid_target
544	4368	WerFault.exe	22
5092	1764	WerFault.exe
4772	1764	WerFault.exe	97
3768	1764	WerFault.exe	97
5064	1764	WerFault.exe	97
2228	1764	WerFault.exe	97
764	1764	WerFault.exe	97
880	1764	WerFault.exe	97
2920	1764	WerFault.exe	97
3280	1764	WerFault.exe	97
1636	1764	WerFault.exe	97
2252	1764	WerFault.exe	97
4888	1764	WerFault.exe	97
3280	1764	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	52809efae9ec20e09e8a1aa35e1af1a5.exe
1764	52809efae9ec20e09e8a1aa35e1af1a5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4368	52809efae9ec20e09e8a1aa35e1af1a5.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1764	52809efae9ec20e09e8a1aa35e1af1a5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1764	4368	52809efae9ec20e09e8a1aa35e1af1a5.exe	97
PID 4368 wrote to memory of 1764	4368	52809efae9ec20e09e8a1aa35e1af1a5.exe	97
PID 4368 wrote to memory of 1764	4368	52809efae9ec20e09e8a1aa35e1af1a5.exe	97

C:\Users\Admin\AppData\Local\Temp\52809efae9ec20e09e8a1aa35e1af1a5.exe
"C:\Users\Admin\AppData\Local\Temp\52809efae9ec20e09e8a1aa35e1af1a5.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 352
  2⤵
  - Program crash
  PID:544
- C:\Users\Admin\AppData\Local\Temp\52809efae9ec20e09e8a1aa35e1af1a5.exe
  C:\Users\Admin\AppData\Local\Temp\52809efae9ec20e09e8a1aa35e1af1a5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 636
    3⤵
    - Program crash
    PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 644
    3⤵
    - Program crash
    PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 680
    3⤵
    - Program crash
    PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 720
    3⤵
    - Program crash
    PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 860
    3⤵
    - Program crash
    PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1408
    3⤵
    - Program crash
    PID:880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1448
    3⤵
    - Program crash
    PID:2920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1648
    3⤵
    - Program crash
    PID:3280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1472
    3⤵
    - Program crash
    PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1648
    3⤵
    - Program crash
    PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1548
    3⤵
    - Program crash
    PID:4888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1676
    3⤵
    - Program crash
    PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4368 -ip 4368
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 352
1⤵
- Program crash
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1764 -ip 1764
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1764 -ip 1764
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1764 -ip 1764
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1764 -ip 1764
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1764 -ip 1764
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1764 -ip 1764
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1764 -ip 1764
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1764 -ip 1764
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1764 -ip 1764
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1764 -ip 1764
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1764 -ip 1764
1⤵
PID:324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1764 -ip 1764
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\52809efae9ec20e09e8a1aa35e1af1a5.exe

Filesize
25KB

MD5
685f74f7aa71a28959d28a57a448c502

SHA1
e99291e7c4c0c23bd7930703dec4b1e35d2419f5

SHA256
5f7301d4fd3294ef2777b6dab68775597e7c70e4c8f1f9c4c978e22009ea270c

SHA512
d400ae0bbd0db5efc3fef42eae5cfd768f03cfff0a83d303608ee4a01131ed8e65c0fb89e975a27357731a3ab2a748723ffc4da2bc65e383a7709a47bb0061f4

Download Submit
memory/1764-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1764-9-0x0000000004F90000-0x0000000005075000-memory.dmp

Filesize
916KB

Download
memory/1764-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1764-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1764-24-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download
memory/4368-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4368-6-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download

Analysis

Sharing