5e5b256424501cafbfab2a1979cbf9437da64ccbd6951658279e684ca29f0427

General

Target
2ca83e6455a46283159688493c79c1c5.exe
Size 1.6MB
Sample231231-hv7qaacbep
SHA256 5e5b256424501cafbfab2a1979cbf9437da64ccbd6951658279e684ca29f0427
MD5 2ca83e6455a46283159688493c79c1c5
SHA1 6a69132e44e34c17eed34f0844fc97948da0301a
SHA512 2cf3578553403c6a7680b7cc8407671bb57395050cc5dcb70f61dd421b86671071460b5be3b01cc93adc6e50056a483cfe1f3d104ba0f1628cb1966c199820f0
SSDEEP 49152:pEoOR+mL33zqzcakLz0B/rCx3NIFpcakLz0O:pE9R+mrDAcakcVrCFNIFpcakcO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2512	2ca83e6455a46283159688493c79c1c5.exe

Executes dropped EXE 1 IoCs

pid	Process
2512	2ca83e6455a46283159688493c79c1c5.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3796-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral2/memory/2512-15-0x0000000000400000-0x000000000065C000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 18 IoCs

pid	pid_target	Process	procid_target
1276	2512	WerFault.exe
3344	2512	WerFault.exe
4600	2512	WerFault.exe
2544	2512	WerFault.exe
3428	2512	WerFault.exe	35
4384	2512	WerFault.exe	35
1648	2512	WerFault.exe	35
60	2512	WerFault.exe	35
3708	2512	WerFault.exe	35
4356	2512	WerFault.exe	35
1640	2512	WerFault.exe	35
1688	2512	WerFault.exe	35
3164	2512	WerFault.exe	35
2668	2512	WerFault.exe	35
3400	2512	WerFault.exe	35
1116	2512	WerFault.exe	35
1676	2512	WerFault.exe	35
436	2512	WerFault.exe	35

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3976	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3796	2ca83e6455a46283159688493c79c1c5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3796	2ca83e6455a46283159688493c79c1c5.exe
2512	2ca83e6455a46283159688493c79c1c5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2512	3796	2ca83e6455a46283159688493c79c1c5.exe	35
PID 3796 wrote to memory of 2512	3796	2ca83e6455a46283159688493c79c1c5.exe	35
PID 3796 wrote to memory of 2512	3796	2ca83e6455a46283159688493c79c1c5.exe	35
PID 2512 wrote to memory of 3976	2512	2ca83e6455a46283159688493c79c1c5.exe	19
PID 2512 wrote to memory of 3976	2512	2ca83e6455a46283159688493c79c1c5.exe	19
PID 2512 wrote to memory of 3976	2512	2ca83e6455a46283159688493c79c1c5.exe	19
PID 2512 wrote to memory of 1832	2512	2ca83e6455a46283159688493c79c1c5.exe	27
PID 2512 wrote to memory of 1832	2512	2ca83e6455a46283159688493c79c1c5.exe	27
PID 2512 wrote to memory of 1832	2512	2ca83e6455a46283159688493c79c1c5.exe	27
PID 1832 wrote to memory of 1828	1832	cmd.exe	20
PID 1832 wrote to memory of 1828	1832	cmd.exe	20
PID 1832 wrote to memory of 1828	1832	cmd.exe	20

C:\Users\Admin\AppData\Local\Temp\2ca83e6455a46283159688493c79c1c5.exe
"C:\Users\Admin\AppData\Local\Temp\2ca83e6455a46283159688493c79c1c5.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\2ca83e6455a46283159688493c79c1c5.exe
  C:\Users\Admin\AppData\Local\Temp\2ca83e6455a46283159688493c79c1c5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 708
    3⤵
    - Program crash
    PID:3428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 756
    3⤵
    - Program crash
    PID:4384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1456
    3⤵
    - Program crash
    PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1912
    3⤵
    - Program crash
    PID:60
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 2144
    3⤵
    - Program crash
    PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 2096
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1948
    3⤵
    - Program crash
    PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1916
    3⤵
    - Program crash
    PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1940
    3⤵
    - Program crash
    PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1976
    3⤵
    - Program crash
    PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1920
    3⤵
    - Program crash
    PID:3400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1964
    3⤵
    - Program crash
    PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1968
    3⤵
    - Program crash
    PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 624
    3⤵
    - Program crash
    PID:436

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\2ca83e6455a46283159688493c79c1c5.exe" /TN 0Su7L8S745c1 /F
1⤵
- Creates scheduled task(s)
PID:3976

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Query /XML /TN 0Su7L8S745c1
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2512 -ip 2512
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 612
1⤵
- Program crash
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks.exe /Query /XML /TN 0Su7L8S745c1 > C:\Users\Admin\AppData\Local\Temp\OkeZvjxO.xml
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2512 -ip 2512
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 628
1⤵
- Program crash
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2512 -ip 2512
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 636
1⤵
- Program crash
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2512 -ip 2512
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 732
1⤵
- Program crash
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2512 -ip 2512
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2512 -ip 2512
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2512 -ip 2512
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2512 -ip 2512
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2512 -ip 2512
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2512 -ip 2512
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2512 -ip 2512
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2512 -ip 2512
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2512 -ip 2512
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2512 -ip 2512
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2512 -ip 2512
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2512 -ip 2512
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2512 -ip 2512
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2512 -ip 2512
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-15-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/2512-19-0x00000000018C0000-0x000000000193E000-memory.dmp

Download

memory/2512-24-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2512-23-0x0000000000470000-0x00000000004DB000-memory.dmp

Download

memory/2512-41-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/3796-0-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/3796-5-0x0000000001730000-0x00000000017AE000-memory.dmp

Download

memory/3796-14-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/3796-1-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads