Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-05-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe
Resource
win10v2004-20240508-en
General
-
Target
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe
-
Size
345KB
-
MD5
44f51057f81a176e9f8c17797190a480
-
SHA1
10e658e1cf6809be37086f97a1f55f47863705ec
-
SHA256
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26
-
SHA512
8adc6e6ab14b3804b04fa746dd4765f1246b29a15c502631b0eaee493e5ae4b69044157e98c2d51f6d5a145315a48de355273d81184351bc86c83b8f14d86dd8
-
SSDEEP
6144:YeN7gDxYwV/bJKo76+l+2oeU4L+jsLwqWwIKDH7iY3ZCizw7LDl5M:YeguwVjp4eGYLwq2KDH7JUV5M
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2068 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 4484 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1780 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 3552 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 708 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1772 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 4332 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 4932 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 3792 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 2572 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 924 1092 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4636 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4636 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.execmd.exedescription pid process target process PID 1092 wrote to memory of 384 1092 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 1092 wrote to memory of 384 1092 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 1092 wrote to memory of 384 1092 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 384 wrote to memory of 4636 384 cmd.exe taskkill.exe PID 384 wrote to memory of 4636 384 cmd.exe taskkill.exe PID 384 wrote to memory of 4636 384 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe"C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 9642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 9682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 11042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 16562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 16042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1092 -ip 10921⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4P8YSYM\advdlc[1].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
memory/1092-1-0x0000000000400000-0x0000000002CB4000-memory.dmpFilesize
40.7MB
-
memory/1092-2-0x0000000000400000-0x0000000002CB4000-memory.dmpFilesize
40.7MB
-
memory/1092-7-0x0000000010000000-0x000000001001C000-memory.dmpFilesize
112KB
-
memory/1092-13-0x0000000000400000-0x0000000002CB4000-memory.dmpFilesize
40.7MB
-
memory/1092-23-0x0000000000400000-0x0000000002CB4000-memory.dmpFilesize
40.7MB
-
memory/1092-31-0x0000000000400000-0x0000000002CB4000-memory.dmpFilesize
40.7MB