061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69

General

Target
061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
Size 1.4MB
Sample240527-w3vbtadc21
SHA256 061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69
MD5 463448f8da60ce6ad9591f7f970146be
SHA1 4be5de8ca3b32d1f08e218dea121fab9f8b3a7aa
SHA512 9439a929e532bbcf27f21308cb04e1d47292a6004141c27cdfbdc8c8dc254dd6e4c8acc169dc13077de90ced858719615d646823211e1a06137afc4f6a32c275
SSDEEP 24576:Op3w4HcXSyggL9LSZd0a/ZSa77sFZTDleyJohauNb0XGjm:Op3wFCyg600gFghcyJokuN4XGjm
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/4724-8-0x0000000000400000-0x00000000004A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/4724-26-0x000000000B9E0000-0x000000000BA83000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Deletes itself 1 IoCs

pid	Process
4724	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Executes dropped EXE 1 IoCs

pid	Process
4724	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
20	pastebin.com
21	pastebin.com

Program crash 16 IoCs

pid	pid_target	Process	procid_target
3380	4296	WerFault.exe	90
3452	4724	WerFault.exe	95
2276	4724	WerFault.exe	95
3912	4724	WerFault.exe	95
2624	4724	WerFault.exe	95
1600	4724	WerFault.exe	95
5052	4724	WerFault.exe	95
444	4724	WerFault.exe	95
408	4724	WerFault.exe	95
2976	4724	WerFault.exe	95
4340	4724	WerFault.exe	95
1420	4724	WerFault.exe	95
3248	4724	WerFault.exe	95
3512	4724	WerFault.exe	95
4352	4724	WerFault.exe	95
4556	4724	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
4724	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4296	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4724	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4724	4296	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	95
PID 4296 wrote to memory of 4724	4296	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	95
PID 4296 wrote to memory of 4724	4296	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	95

C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
"C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 344
  2⤵
  - Program crash
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
  C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 344
    3⤵
    - Program crash
    PID:3452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 636
    3⤵
    - Program crash
    PID:2276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 672
    3⤵
    - Program crash
    PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 652
    3⤵
    - Program crash
    PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 720
    3⤵
    - Program crash
    PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 904
    3⤵
    - Program crash
    PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1400
    3⤵
    - Program crash
    PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1408
    3⤵
    - Program crash
    PID:408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1636
    3⤵
    - Program crash
    PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1504
    3⤵
    - Program crash
    PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1484
    3⤵
    - Program crash
    PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1480
    3⤵
    - Program crash
    PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1640
    3⤵
    - Program crash
    PID:3512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1544
    3⤵
    - Program crash
    PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 640
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4296 -ip 4296
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4724 -ip 4724
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4724 -ip 4724
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4724 -ip 4724
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4724 -ip 4724
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4724 -ip 4724
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4724 -ip 4724
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4724 -ip 4724
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4724 -ip 4724
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4724 -ip 4724
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4724 -ip 4724
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4724 -ip 4724
1⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4724 -ip 4724
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4724 -ip 4724
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Path C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
Size 1.4MB
SHA256 2eacb606db229e3fc6145b2f4bbe135dd761815b6cb3977f3226281fbf8ef50b
MD5 e51af08d6143a67b643812315c8f8fc1
SHA1 3e168cec727bf560956b143c2d121d58b07d4fee
SHA512 ae94a6a0cbfcc51c1a4d1ce876fa76f8262d980374045136781154cbe258cec314d922c88493492a85bb8fac99a45a386a04b479db1f2ec1111fe63d2fbd673a
SSDEEP 24576:RuPJY4nD25S6at5U4Q2MGibJViVBTlSHfRTVa/ZSa77sFZTDleyJohauNb0XGjm:FwO+7BkOSHfngFghcyJokuN4XGjm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4296-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4724-6-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4724-7-0x0000000004F90000-0x000000000507C000-memory.dmp

Download

memory/4724-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4724-26-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Download

memory/4724-20-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads