Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
-
Size
287KB
-
MD5
9302856c12e8253ff564944f51380b3e
-
SHA1
4d8a59d66cdcbbb46ae0686116dafd112bc249d5
-
SHA256
3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c
-
SHA512
966e1f3489b078422ef4292b820975cfd7a7286bf48b840eb434e78245c5890b00adfbd0029804ef5c6da07d34447d6dd525b7e5858fc7a647c496e69f8de007
-
SSDEEP
3072:BzUt6pKTpaHNKl09wZnDul/INY4Ub5uRmAe4SPdJ8iP1+btZXARNzn4njMXr/FLK:ymHNK61N1uAAr088Ywn4nkJHVAF23M
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3792 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 3084 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 1408 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 4492 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 1140 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 3348 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 532 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 3092 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe 1656 2980 WerFault.exe 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe"C:\Users\Admin\AppData\Local\Temp\3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe"1⤵PID:2980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 4522⤵
- Program crash
PID:3792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 4882⤵
- Program crash
PID:3084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 7482⤵
- Program crash
PID:1408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 7882⤵
- Program crash
PID:4492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 8282⤵
- Program crash
PID:1140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 8562⤵
- Program crash
PID:3348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 9122⤵
- Program crash
PID:532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 9202⤵
- Program crash
PID:3092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 7522⤵
- Program crash
PID:1656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2980 -ip 29801⤵PID:1304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2980 -ip 29801⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2980 -ip 29801⤵PID:2812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2980 -ip 29801⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2980 -ip 29801⤵PID:1832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2980 -ip 29801⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2980 -ip 29801⤵PID:2328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2980 -ip 29801⤵PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2980 -ip 29801⤵PID:4836
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2980-1-0x00000000006E0000-0x00000000007E0000-memory.dmpFilesize
1024KB
-
memory/2980-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2980-2-0x00000000005F0000-0x000000000062C000-memory.dmpFilesize
240KB
-
memory/2980-4-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2980-6-0x00000000006E0000-0x00000000007E0000-memory.dmpFilesize
1024KB
-
memory/2980-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB