0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c

General

Target

0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe
Size

6.6MB
MD5

b8d493afa1e5ed5d0cd65d1ddd53ecb5
SHA1

90d8397d8c2c194d5a20407606a8945f5982e10b
SHA256

0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c
SHA512

e7fc98d75331fbe393001b19bece92319c0d7151f8b737dac434676f33c8091726c19a44bd46eff6d2b5437a4367424f65e37fb2c69b023747be99fe9018f540
SSDEEP

98304:Lv+9DaKkSQQMFDW7X6ZZwQQMFAhsWsQQMFDW7X6ZZwQQMFC1gA:Lv+ZaKkSpiWT6ZypqpiWT6ZypJ1gA

Score

9^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/1972-9-0x0000000000400000-0x00000000004A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/1972-23-0x000000000B9E0000-0x000000000BA83000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Deletes itself 1 IoCs

pid	Process
1972	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Executes dropped EXE 1 IoCs

pid	Process
1972	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
46	pastebin.com
47	pastebin.com

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4644	4404	WerFault.exe	94
4368	1972	WerFault.exe	105
3664	1972	WerFault.exe	105
4332	1972	WerFault.exe	105
3740	1972	WerFault.exe	105
656	1972	WerFault.exe	105
4748	1972	WerFault.exe	105
1236	1972	WerFault.exe	105
544	1972	WerFault.exe	105
3448	1972	WerFault.exe	105
1288	1972	WerFault.exe	105
976	1972	WerFault.exe	105
3960	1972	WerFault.exe	105

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1972	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe
1972	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4404	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1972	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1972	4404	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe	105
PID 4404 wrote to memory of 1972	4404	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe	105
PID 4404 wrote to memory of 1972	4404	0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe	105

C:\Users\Admin\AppData\Local\Temp\0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe
"C:\Users\Admin\AppData\Local\Temp\0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 344
  2⤵
  - Program crash
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe
  C:\Users\Admin\AppData\Local\Temp\0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 344
    3⤵
    - Program crash
    PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 636
    3⤵
    - Program crash
    PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 668
    3⤵
    - Program crash
    PID:4332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 668
    3⤵
    - Program crash
    PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 724
    3⤵
    - Program crash
    PID:656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 916
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1404
    3⤵
    - Program crash
    PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1412
    3⤵
    - Program crash
    PID:544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1668
    3⤵
    - Program crash
    PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1492
    3⤵
    - Program crash
    PID:1288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1532
    3⤵
    - Program crash
    PID:976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1564
    3⤵
    - Program crash
    PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4404 -ip 4404
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1972 -ip 1972
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1972 -ip 1972
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1972 -ip 1972
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1972 -ip 1972
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1972 -ip 1972
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1972 -ip 1972
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1972 -ip 1972
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1972 -ip 1972
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1972 -ip 1972
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0a0548348bc0fa9cfb2d14fb957ca47358a4a5ab9c2aa2237629d63699b5ba5c.exe

Filesize
6.6MB

MD5
9b077116130dcad7076b20ec3fc21835

SHA1
cdfdd8d4910dffacc47b06419a1f461a9239a568

SHA256
7a66d4cfccb65aa97b4cadffc96bd47608538a6d2fc24a2755d28157e0dafd62

SHA512
3a4a5567fec73cba4851f2da9da4307ac4d55e4caa84a3129cc77b2079e261a02e18c64d325ea753fd59cf36f0e38853efbe8d9f6f843a8435d63340b7465c66

Download Submit
memory/1972-7-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/1972-8-0x0000000005020000-0x000000000510E000-memory.dmp

Filesize
952KB

Download
memory/1972-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1972-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1972-23-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Filesize
652KB

Download
memory/4404-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/4404-6-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download

Analysis

Sharing