Analysis
-
max time kernel
92s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-05-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe
Resource
win10v2004-20240226-en
General
-
Target
5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe
-
Size
369KB
-
MD5
d13d52fa632b4c6606b7874fc6733e28
-
SHA1
091b649bdd1ee951face5c07adde64fe29838216
-
SHA256
5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25
-
SHA512
17e0fc87f0d4d0024d210d267aa9aeadf1bbab40933fef040a19a34b7cb86d0fe93c61e060971e81209807ee4807236500194bf6aeb483cac4492a995af6c165
-
SSDEEP
6144:VST5HihCi8OLdnmSzu2f5JeEhNBlG7LTlcM:VGHni8OpnmSVe5VcM
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3632 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 3128 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 4700 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 1852 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 3952 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 2064 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 2540 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 3992 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 4112 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe 4212 2400 WerFault.exe 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1232 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1232 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.execmd.exedescription pid process target process PID 2400 wrote to memory of 1904 2400 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe cmd.exe PID 2400 wrote to memory of 1904 2400 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe cmd.exe PID 2400 wrote to memory of 1904 2400 5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe cmd.exe PID 1904 wrote to memory of 1232 1904 cmd.exe taskkill.exe PID 1904 wrote to memory of 1232 1904 cmd.exe taskkill.exe PID 1904 wrote to memory of 1232 1904 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe"C:\Users\Admin\AppData\Local\Temp\5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 5322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 9682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 16402⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "5e8ba08b4ed7c18743fa6408c6aba9995d6073a38a6e8bf4f20f962aa84e9b25.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 15922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2400 -ip 24001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C76012RU\advdlc[1].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
memory/2400-1-0x0000000002D40000-0x0000000002E40000-memory.dmpFilesize
1024KB
-
memory/2400-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-2-0x00000000049C0000-0x00000000049FC000-memory.dmpFilesize
240KB
-
memory/2400-8-0x0000000010000000-0x000000001001C000-memory.dmpFilesize
112KB
-
memory/2400-15-0x0000000000400000-0x0000000002CBA000-memory.dmpFilesize
40.7MB
-
memory/2400-22-0x0000000002D40000-0x0000000002E40000-memory.dmpFilesize
1024KB
-
memory/2400-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-33-0x0000000000400000-0x0000000002CBA000-memory.dmpFilesize
40.7MB