ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50

General

Target

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
Size

416KB
MD5

b0923dddb85b09333f969a8536e684c2
SHA1

82c0d75cfb413226c1a0a5c2d9e38ed4723e8f39
SHA256

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50
SHA512

06d58fea53a8dd9c513212d681fb074afbc99f73f83a4481720bf097fa14fd73923374cbac2937bf55af9567f87f381e4cc28e39176668790615e16bb2d3e026
SSDEEP

6144:1jKUkZNboWLtbUBfTi96tYa1UWdDJboY4sJ9pALL7j1aFwoF:1jKUkLbfUB7oNa1U6D9d9pAi

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid process

4124 ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
Executes dropped EXE 1 IoCs

Processes:

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid process

4124 ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid	process
4124	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid	process
4124	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3296	1692	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
3152	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
440	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
4424	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
744	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
1408	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
2528	4124	WerFault.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid process

1692 ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid process

4124 ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid	process
1692	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

pid	process
4124	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

description	pid	process	target process
PID 1692 wrote to memory of 4124	1692	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
PID 1692 wrote to memory of 4124	1692	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
PID 1692 wrote to memory of 4124	1692	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe	ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe

C:\Users\Admin\AppData\Local\Temp\ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
"C:\Users\Admin\AppData\Local\Temp\ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 384
2⤵
- Program crash
PID:3296

C:\Users\Admin\AppData\Local\Temp\ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
C:\Users\Admin\AppData\Local\Temp\ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 360
3⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 768
3⤵
- Program crash
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 788
3⤵
- Program crash
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 796
3⤵
- Program crash
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 776
3⤵
- Program crash
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 772
3⤵
- Program crash
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1692 -ip 1692
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4124 -ip 4124
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4124 -ip 4124
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4124 -ip 4124
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4124 -ip 4124
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4124 -ip 4124
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4124 -ip 4124
1⤵
PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ba2b372ecfd8c59f6d5c8d640c9709131b7c6669f6f69cfb847ba4d6b432ad50.exe
Filesize
416KB

MD5
304d0cddad14a91d9ff9be3c81d37e3a

SHA1
54b485d6d1532ceac70bb4f825921a7eb434035d

SHA256
2d27f693d637e2d2cc42d718319411403f376f3a80bf6ec29370c1a8a55e0ebb

SHA512
a0fb89c112eb2de527fefeacc8eca3a7daa80ca0387dd654b7665d47bb66036e92a224866dd8e7d6826446e64ce17762c72c351991dfc416186870784ed87be2

Download Submit
memory/1692-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1692-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4124-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4124-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4124-8-0x00000000014C0000-0x00000000014F6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing