Resubmissions
24-09-2022 21:20
220924-z6qdtaddbl 10Analysis
-
max time kernel
1784s -
max time network
1179s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win10v2004-20240412-en
General
-
Target
5e6764534b3a1e4d3abacc4810b6985d.exe
-
Size
740KB
-
MD5
5e6764534b3a1e4d3abacc4810b6985d
-
SHA1
f10ad287f126f577f197070453812a7e88c2cc52
-
SHA256
e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0
-
SHA512
532d2855e1b21433dbcc9c803f0538d99f6c3bddf0dd8321f552c7d16914dce4c2d2d3abd8028f45a4cf18109d430251d8fe8c63d30627e6fcc27d54cb42a188
-
SSDEEP
12288:az1bWgRkItsxHeYfpGcix2wytmyKsqVwoiFNoQEN5:+RkItsl7fofyKsqVwoiFNoQE3
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 44 api.ipify.org 45 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2448 4808 WerFault.exe wermgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wermgr.exepid process 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe 4808 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5e6764534b3a1e4d3abacc4810b6985d.exewermgr.exepid process 6016 5e6764534b3a1e4d3abacc4810b6985d.exe 4808 wermgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
5e6764534b3a1e4d3abacc4810b6985d.exedescription pid process target process PID 6016 wrote to memory of 4808 6016 5e6764534b3a1e4d3abacc4810b6985d.exe wermgr.exe PID 6016 wrote to memory of 4808 6016 5e6764534b3a1e4d3abacc4810b6985d.exe wermgr.exe PID 6016 wrote to memory of 4808 6016 5e6764534b3a1e4d3abacc4810b6985d.exe wermgr.exe PID 6016 wrote to memory of 4808 6016 5e6764534b3a1e4d3abacc4810b6985d.exe wermgr.exe PID 6016 wrote to memory of 4808 6016 5e6764534b3a1e4d3abacc4810b6985d.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\System32\wermgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 10443⤵
- Program crash
PID:2448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4808 -ip 48081⤵PID:3096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4808-8-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-3-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-9-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-10-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4808-5-0x0000000000E50000-0x0000000000E55000-memory.dmpFilesize
20KB
-
memory/4808-4-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-6-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-7-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-41-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-1-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-2-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-18-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-21-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-24-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-30-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-34-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/4808-38-0x00000000010B0000-0x000000000114A000-memory.dmpFilesize
616KB
-
memory/6016-0-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB