Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe
Resource
win10v2004-20240226-en
General
-
Target
40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe
-
Size
2.4MB
-
MD5
8274d564cfe76ee9e82fca4ec5132134
-
SHA1
796d6be60f49fa22944bf5499f3648965e3bf323
-
SHA256
40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb
-
SHA512
27b37f4b321c5704def5a2f8ac54a7375dba07baef6c450cb279a70d0405af14c657e063e97cdcc8ca07f852dc43645cd7225bcb8af0191a628c4b32ee7ac119
-
SSDEEP
49152:mm/cJ/XjKoC3m/g7grNZbNsm+kwjI4TT86lorVlyR0Wx:f+fW32nNZZshK4n86WrWDx
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
resource yara_rule behavioral2/memory/4192-8-0x0000000000400000-0x00000000004A3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral2/memory/4192-26-0x000000000B9D0000-0x000000000BA73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Deletes itself 1 IoCs
pid Process 4192 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe -
Executes dropped EXE 1 IoCs
pid Process 4192 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 42 pastebin.com 44 pastebin.com -
Program crash 13 IoCs
pid pid_target Process procid_target 1252 4192 WerFault.exe 94 5112 4192 WerFault.exe 94 4380 4192 WerFault.exe 94 2460 4192 WerFault.exe 94 1148 4192 WerFault.exe 94 3620 4192 WerFault.exe 94 4880 4192 WerFault.exe 94 3540 4192 WerFault.exe 94 4840 4192 WerFault.exe 94 864 4192 WerFault.exe 94 4948 4192 WerFault.exe 94 4036 4192 WerFault.exe 94 3284 4192 WerFault.exe 94 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4192 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe 4192 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3164 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4192 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3164 wrote to memory of 4192 3164 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe 94 PID 3164 wrote to memory of 4192 3164 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe 94 PID 3164 wrote to memory of 4192 3164 40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe"C:\Users\Admin\AppData\Local\Temp\40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exeC:\Users\Admin\AppData\Local\Temp\40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 3443⤵
- Program crash
PID:1252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6363⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6603⤵
- Program crash
PID:4380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6603⤵
- Program crash
PID:2460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 7203⤵
- Program crash
PID:1148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 9483⤵
- Program crash
PID:3620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 14043⤵
- Program crash
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 14123⤵
- Program crash
PID:3540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 14763⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 17083⤵
- Program crash
PID:864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 17203⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 14123⤵
- Program crash
PID:4036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 16963⤵
- Program crash
PID:3284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3164 -ip 31641⤵PID:1784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4192 -ip 41921⤵PID:3948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4192 -ip 41921⤵PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4192 -ip 41921⤵PID:688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4192 -ip 41921⤵PID:4876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4192 -ip 41921⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4192 -ip 41921⤵PID:5100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4192 -ip 41921⤵PID:1552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4192 -ip 41921⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4192 -ip 41921⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4192 -ip 41921⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4192 -ip 41921⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4192 -ip 41921⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4192 -ip 41921⤵PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\40f1acb19b0b73560142a6924d4c5e31a53ef284ed92ecf8133b9174320e52fb.exe
Filesize2.4MB
MD5d556784f9edee7d4ec34dd693bb6e3e3
SHA1870aad0b7515b52181682b6ee6a2e6ef0c86a9dc
SHA256dd98bc57103b0fa323e475eaa4af8adb5f1c5b138ed7cfbc497446912f8d0e0a
SHA512a033ffc344bf86167b3bde34ae4ff8f538ea6edf1c1905ab2f424ee1cc17a124341f0ebf145e28639bc28717975bcd852860c141d69ff85ae7bb9c7d957fe19a