3981304ae7cc29ceabc5c6286b9c690915c270900d2a78464fa22f6f56729563

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Size

12.6MB
MD5

19aa54a30ff7cdf81c177161976e6cd1
SHA1

605f4d808387e68475e6fc6bc6972bfe55e8a4c8
SHA256

3981304ae7cc29ceabc5c6286b9c690915c270900d2a78464fa22f6f56729563
SHA512

29a3ce73408da7c9c06d13511fb06c85cf8c41fce4fd192f5c150bd498caef05ea3b144fa6cdf6e7043250065bb00d2252874c9bee1bf1b888a67b23d42c3cff
SSDEEP

393216:1UFKsMorXmYwtQQlTX3zxPYvkS8Yy/CmnL4:18ZXmYw6AT1QExn

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

pid process

2036 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 discord.com
5 discord.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2360 2036 WerFault.exe 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

description pid process

Token: SeDebugPrivilege 2036 1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

pid	process
2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

flow	ioc
4	discord.com
5	discord.com

pid	pid_target	process	target process
2360	2036	WerFault.exe	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

description	pid	process
Token: SeDebugPrivilege	2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe

description	pid	process	target process
PID 2036 wrote to memory of 2360	2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe	WerFault.exe
PID 2036 wrote to memory of 2360	2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe	WerFault.exe
PID 2036 wrote to memory of 2360	2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe	WerFault.exe
PID 2036 wrote to memory of 2360	2036	1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1816-147-0x00000000132A0000-0x0000000013F42000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1600
2⤵
- Program crash
PID:2360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A63.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll
Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
memory/2036-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x0000000001370000-0x0000000002012000-memory.dmp

Filesize
12.6MB

Download
memory/2036-2-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-44-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2036-45-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download