3695303520227d0324f81f16954010765cdaa034e96a1c4854b0879589715edf

General

Target

9b04a17c1681b89741f0b0c42e50a02c.exe
Size

1.3MB
MD5

9b04a17c1681b89741f0b0c42e50a02c
SHA1

bdca8b46cf7aa9fd99bbd2e93004ac27ce286338
SHA256

3695303520227d0324f81f16954010765cdaa034e96a1c4854b0879589715edf
SHA512

a8e06ffe51646620ab98d5e3c18d119372ecbe6bb2a42e49e7e454d2dfd557dbecfca8791882e531c8a7f1793a22a5e78d88598b66adb42f1ce6a27ab3375653
SSDEEP

24576:Cr2IGlkjGy8m/rBE/Xgqosa/ZSE0E77sFZTDleyVVv:gWSjs06/Rdgl0EghcyVVv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2420	9b04a17c1681b89741f0b0c42e50a02c.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	9b04a17c1681b89741f0b0c42e50a02c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	pastebin.com
30	pastebin.com

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2928	4832	WerFault.exe	91
2212	2420	WerFault.exe	101
660	2420	WerFault.exe	101
5048	2420	WerFault.exe	101
4932	2420	WerFault.exe	101
1828	2420	WerFault.exe	101
4928	2420	WerFault.exe	101
1532	2420	WerFault.exe	101
3628	2420	WerFault.exe	101
2864	2420	WerFault.exe	101
8	2420	WerFault.exe	101
1064	2420	WerFault.exe	101

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	9b04a17c1681b89741f0b0c42e50a02c.exe
2420	9b04a17c1681b89741f0b0c42e50a02c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4832	9b04a17c1681b89741f0b0c42e50a02c.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2420	9b04a17c1681b89741f0b0c42e50a02c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2420	4832	9b04a17c1681b89741f0b0c42e50a02c.exe	101
PID 4832 wrote to memory of 2420	4832	9b04a17c1681b89741f0b0c42e50a02c.exe	101
PID 4832 wrote to memory of 2420	4832	9b04a17c1681b89741f0b0c42e50a02c.exe	101

C:\Users\Admin\AppData\Local\Temp\9b04a17c1681b89741f0b0c42e50a02c.exe
"C:\Users\Admin\AppData\Local\Temp\9b04a17c1681b89741f0b0c42e50a02c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 344
  2⤵
  - Program crash
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\9b04a17c1681b89741f0b0c42e50a02c.exe
  C:\Users\Admin\AppData\Local\Temp\9b04a17c1681b89741f0b0c42e50a02c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 344
    3⤵
    - Program crash
    PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 636
    3⤵
    - Program crash
    PID:660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 636
    3⤵
    - Program crash
    PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 692
    3⤵
    - Program crash
    PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 708
    3⤵
    - Program crash
    PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 896
    3⤵
    - Program crash
    PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1396
    3⤵
    - Program crash
    PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1452
    3⤵
    - Program crash
    PID:3628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1512
    3⤵
    - Program crash
    PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1572
    3⤵
    - Program crash
    PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1656
    3⤵
    - Program crash
    PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 4832 -ip 4832
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2420 -ip 2420
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2420 -ip 2420
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2420 -ip 2420
1⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2420 -ip 2420
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2420 -ip 2420
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2420 -ip 2420
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2420 -ip 2420
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2420 -ip 2420
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2420 -ip 2420
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2420 -ip 2420
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2420 -ip 2420
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9b04a17c1681b89741f0b0c42e50a02c.exe

Filesize
1.3MB

MD5
334038cd21c212d655e2fa060da27483

SHA1
e09493dc637ff963cb89c0c2204cbdd42920796d

SHA256
888e5dfc36c3c085f434d81cc55691dea3953d2414f76cc2a017a18f9895fead

SHA512
1a4e30af4d3444d8950d30764a4c96596c08ca3c2ab9e71eb3400699abfd3cafbe8d4adee71e9a6b6ac3db8ad2ec0250f13def0afdbeafa60f6ac3b126370752

Download Submit
memory/2420-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2420-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2420-9-0x0000000005040000-0x000000000512F000-memory.dmp

Filesize
956KB

Download
memory/2420-20-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download
memory/2420-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4832-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4832-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing