75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20

General

Target

75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe
Size

2.0MB
MD5

972ed5206a94a5474965a5b0ed117098
SHA1

4bf5a7f5e7e32362b871c78fe88b215f7338f0af
SHA256

75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20
SHA512

7db1632758a21deedf75f14839b03a083d782bd00cf7d5877940a5f298f85b52c4921d16aafb17e0cf4244ce7bc1e1022eceb0e83dbd5a3a55669ec0e867e231
SSDEEP

49152:xJ9CyFfR0P/WHygXgJbNsm+kwjI4TT86lorVld:F6OEZshK4n86WrB

Score

9^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/1304-9-0x0000000000400000-0x00000000004A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/1304-20-0x000000000B9E0000-0x000000000BA83000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Deletes itself 1 IoCs

pid	Process
1304	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Executes dropped EXE 1 IoCs

pid	Process
1304	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
18	pastebin.com

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2144	3568	WerFault.exe	83
892	1304	WerFault.exe	92
4384	1304	WerFault.exe	92
2988	1304	WerFault.exe	92
1640	1304	WerFault.exe	92
4016	1304	WerFault.exe	92
4720	1304	WerFault.exe	92
3576	1304	WerFault.exe	92
4644	1304	WerFault.exe	92
5048	1304	WerFault.exe	92
4620	1304	WerFault.exe	92
4544	1304	WerFault.exe	92
344	1304	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe
1304	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3568	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1304	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1304	3568	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe	92
PID 3568 wrote to memory of 1304	3568	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe	92
PID 3568 wrote to memory of 1304	3568	75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe	92

C:\Users\Admin\AppData\Local\Temp\75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe
"C:\Users\Admin\AppData\Local\Temp\75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 344
  2⤵
  - Program crash
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe
  C:\Users\Admin\AppData\Local\Temp\75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 344
    3⤵
    - Program crash
    PID:892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 620
    3⤵
    - Program crash
    PID:4384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 672
    3⤵
    - Program crash
    PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 664
    3⤵
    - Program crash
    PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 720
    3⤵
    - Program crash
    PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 920
    3⤵
    - Program crash
    PID:4720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1400
    3⤵
    - Program crash
    PID:3576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1468
    3⤵
    - Program crash
    PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1504
    3⤵
    - Program crash
    PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1448
    3⤵
    - Program crash
    PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1528
    3⤵
    - Program crash
    PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1096
    3⤵
    - Program crash
    PID:344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3568 -ip 3568
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1304 -ip 1304
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1304 -ip 1304
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1304 -ip 1304
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1304 -ip 1304
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1304 -ip 1304
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1304 -ip 1304
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1304 -ip 1304
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1304 -ip 1304
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1304 -ip 1304
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1304 -ip 1304
1⤵
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1304 -ip 1304
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1304 -ip 1304
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\75b30dd3dbd63052cc6bd1e18321995ab1284c7e50eb28ee401e1b2016455d20.exe

Filesize
2.0MB

MD5
8e4037a27a62b1b80dc5add22ab6ec4e

SHA1
c3a8af0c02382bec453cb7b72bd83436a820c5b0

SHA256
2e78b4fb56e36c8f36317b6e7e98b8859b186be7ac7452d2d5a998e542e0d19f

SHA512
5501259d1c78b98e29c3289a76a45fe27ea6ff5f2f716c1b7e12702f67d55bfb56d077b70e5356da006e983a731eff34e7b402685f7e357fafbc12b3c860571a

Download Submit
memory/1304-7-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1304-8-0x0000000005100000-0x0000000005215000-memory.dmp

Filesize
1.1MB

Download
memory/1304-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1304-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1304-20-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Filesize
652KB

Download
memory/1304-25-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3568-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3568-5-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing