d067f66d50b7ffb654e60772295498298206c6390ca66df6f32b3f541634aec2

Analysis

max time kernel
2s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
436b1dc53957b81273867d51e0cb6bd7.exe
Size 1003KB
Sample240105-l875raaef3
SHA256 d067f66d50b7ffb654e60772295498298206c6390ca66df6f32b3f541634aec2
MD5 436b1dc53957b81273867d51e0cb6bd7
SHA1 e96d93f8c20d307bf1a2d82d1abe57006997cad7
SHA512 f483c3b1d5f9343ccad5c8ce1fbe3708e2b6d3892e57f408079dc9c7249eed859cbedab83a19c07267d6086b19e72be58b63f9b29b0ccf134b68f336af7d9486
SSDEEP 24576:q14jt+p27xy+26WzenFkLGQKFhycjukL2CDYibq6/yqLNaF:q145m28+26WinFkiQjcakLz0ibq6yqh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
512	436b1dc53957b81273867d51e0cb6bd7.exe

Executes dropped EXE 1 IoCs

pid	Process
512	436b1dc53957b81273867d51e0cb6bd7.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4172-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral2/memory/512-14-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral2/files/0x00080000000231f0-12.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 18 IoCs

pid	pid_target	Process	procid_target
4868	512	WerFault.exe
2020	512	WerFault.exe
3972	512	WerFault.exe
4592	512	WerFault.exe	32
2688	512	WerFault.exe	32
1208	512	WerFault.exe	32
5052	512	WerFault.exe	32
2976	512	WerFault.exe	32
4128	512	WerFault.exe	32
2864	512	WerFault.exe	32
4116	512	WerFault.exe	32
2480	512	WerFault.exe	32
3232	512	WerFault.exe	32
4516	512	WerFault.exe	32
4712	512	WerFault.exe	32
8	512	WerFault.exe	32
4116	512	WerFault.exe	32
2284	512	WerFault.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3152	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4172	436b1dc53957b81273867d51e0cb6bd7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4172	436b1dc53957b81273867d51e0cb6bd7.exe
512	436b1dc53957b81273867d51e0cb6bd7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 512	4172	436b1dc53957b81273867d51e0cb6bd7.exe	32
PID 4172 wrote to memory of 512	4172	436b1dc53957b81273867d51e0cb6bd7.exe	32
PID 4172 wrote to memory of 512	4172	436b1dc53957b81273867d51e0cb6bd7.exe	32
PID 512 wrote to memory of 3152	512	436b1dc53957b81273867d51e0cb6bd7.exe	19
PID 512 wrote to memory of 3152	512	436b1dc53957b81273867d51e0cb6bd7.exe	19
PID 512 wrote to memory of 3152	512	436b1dc53957b81273867d51e0cb6bd7.exe	19
PID 512 wrote to memory of 776	512	436b1dc53957b81273867d51e0cb6bd7.exe	27
PID 512 wrote to memory of 776	512	436b1dc53957b81273867d51e0cb6bd7.exe	27
PID 512 wrote to memory of 776	512	436b1dc53957b81273867d51e0cb6bd7.exe	27
PID 776 wrote to memory of 1516	776	cmd.exe	21
PID 776 wrote to memory of 1516	776	cmd.exe	21
PID 776 wrote to memory of 1516	776	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe
"C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe
  C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 636
    3⤵
    - Program crash
    PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 720
    3⤵
    - Program crash
    PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 632
    3⤵
    - Program crash
    PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1464
    3⤵
    - Program crash
    PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1916
    3⤵
    - Program crash
    PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2144
    3⤵
    - Program crash
    PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2096
    3⤵
    - Program crash
    PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1932
    3⤵
    - Program crash
    PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2168
    3⤵
    - Program crash
    PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1956
    3⤵
    - Program crash
    PID:3232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2112
    3⤵
    - Program crash
    PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2148
    3⤵
    - Program crash
    PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1928
    3⤵
    - Program crash
    PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1924
    3⤵
    - Program crash
    PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 628
    3⤵
    - Program crash
    PID:2284

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe" /TN 0Su7L8S745c1 /F
1⤵
- Creates scheduled task(s)
PID:3152

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Query /XML /TN 0Su7L8S745c1
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 512 -ip 512
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 612
1⤵
- Program crash
PID:4868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks.exe /Query /XML /TN 0Su7L8S745c1 > C:\Users\Admin\AppData\Local\Temp\kuWRfLEbK.xml
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 512 -ip 512
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 632
1⤵
- Program crash
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 512 -ip 512
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 640
1⤵
- Program crash
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 512 -ip 512
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 512 -ip 512
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 512 -ip 512
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 512 -ip 512
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 512 -ip 512
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 512 -ip 512
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 512 -ip 512
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 512 -ip 512
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 512 -ip 512
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 512 -ip 512
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 512 -ip 512
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 512 -ip 512
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 512 -ip 512
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 512 -ip 512
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 512 -ip 512
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

436b1dc53957b81273867d51e0cb6bd7.exe

Path C:\Users\Admin\AppData\Local\Temp\436b1dc53957b81273867d51e0cb6bd7.exe
Size 1KB
SHA256 28ce484ea12a988e15c679ecf04233c77663e54e7b8ba92c8b706e8b87695ed8
MD5 bc2a25a8f0456ca4cbe7c14002d6645d
SHA1 263a17d9fdb99df0a8a41222f4730ae5ad208ba4
SHA512 bae5c30be6284e2aeea905af66255c22d9c7a771661895884599eccb27e21e73eeecb506450cb6900354ee8730beac7940a42821779b195cb950e4e65de0a5c2
MD5 SHA1 SHA512

Submit Download

kuWRfLEbK.xml

Path C:\Users\Admin\AppData\Local\Temp\kuWRfLEbK.xml
Size 1KB
SHA256 a7b116647f98d04989da64bb4243e46232c9a1c01f43b0e2309c8ef63b2453d1
MD5 055435ca4d6f3414915d5e3b836cf73f
SHA1 a394c5a63acaac5f20ffc56e00665630ef3b1c83
SHA512 a990e5564d89625929899d6130214f256e097dedf56985eb0dc3376b6c5363a678ce66a9477d0d81d3c319690f3c9116b4574ff128802352f0838d3ebb714411
MD5 SHA1 SHA512

Submit Download

memory/512-14-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/512-23-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/512-22-0x0000000000470000-0x00000000004DB000-memory.dmp

Download

memory/512-21-0x0000000025000000-0x000000002507E000-memory.dmp

Download

memory/512-40-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/4172-0-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/4172-4-0x0000000025010000-0x000000002508E000-memory.dmp

Download

memory/4172-1-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/4172-13-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads