Overview
overview
10Static
static
100778d2ae60...93.exe
windows10-2004-x64
102005110ee8...24.exe
windows10-2004-x64
10290072a9e1...51.exe
windows10-2004-x64
103998d0e987...7f.exe
windows10-2004-x64
10435844f4e1...2b.exe
windows10-2004-x64
3495fbfecbc...72.exe
windows10-2004-x64
1542c157186...88.exe
windows10-2004-x64
10561d7f0505...35.exe
windows10-2004-x64
10617364875d...bb.exe
windows10-2004-x64
36312ac9176...d8.exe
windows10-2004-x64
1063545fa195...8a.exe
windows10-2004-x64
106555038a04...42.exe
windows10-2004-x64
10677393ff5e...59.exe
windows10-2004-x64
1680caf0e30...75.exe
windows10-2004-x64
1070192d461c...8b.exe
windows10-2004-x64
376199c2662...6d.exe
windows10-2004-x64
38727091cbb...44.exe
windows10-2004-x64
1091450f9e8a...dc.exe
windows10-2004-x64
993386ea79c...b9.exe
windows10-2004-x64
6942bc9e43e...7c.exe
windows10-2004-x64
10ac7a29cb82...b8.exe
windows10-2004-x64
10baa851154b...1f.exe
windows10-2004-x64
10bb5ca9d8de...69.exe
windows10-2004-x64
10c15e2ffa84...07.exe
windows10-2004-x64
10c743ba0861...26.exe
windows10-2004-x64
cfda742c2d...e5.exe
windows10-2004-x64
10d1d74ec103...34.exe
windows10-2004-x64
1d765e722e2...b9.exe
windows10-2004-x64
10daa41f5230...de.exe
windows10-2004-x64
9ed12ea76d0...0a.exe
windows10-2004-x64
10f062577b68...e0.exe
windows10-2004-x64
10f244a04265...35.exe
windows10-2004-x64
10Resubmissions
13-07-2024 09:54
240713-lxcvgawdmn 1013-07-2024 09:52
240713-lv46yawdkj 1013-07-2024 09:46
240713-lrz3tayajc 10Analysis
-
max time kernel
1357s -
max time network
1146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 09:54
Behavioral task
behavioral1
Sample
0778d2ae6074545731b471360877b58c89ba0aaca6a0ffdb25694340c910cc93.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
2005110ee806a4fb40e00fe6c76af3527e3d66cd828723ee39529942812b8924.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
290072a9e1cf3872487cf586a592be534abc894d20ffd1121fe8338f1b52b451.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
3998d0e987accc2837c6bf87fdb2796d0170ae2a79383b78fd778531410e337f.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
495fbfecbcadb103389cc33828db139fa6d66bece479c7f70279834051412d72.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
542c157186bae766dd3e2df424e9c25251d71086b99cc9df121bc9bf50462688.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
561d7f05055800d3eb9d9e150969e2c84a71dc82a362fb3e1a224af420e53b35.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
617364875d331ab132bac1e63fb9b5a00ac5a33a22b93749dd6ee384ed435dbb.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
6555038a04997404d48cf866ebb81f134082ef1613408779cf2a589068312a42.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
677393ff5efc9f6f050b4b5ed62579f2f050eeec53e7a17cb51c31c148546f59.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
76199c26622c58fa0a22355d710ef06d86e3cce56def3d9a3c38ea395e48066d.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
91450f9e8aeb0361867cdefc0bb7e5bad8941b5081db549d34a91072df4db5dc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
93386ea79c58a95c033e66da99d155264f0028a43973a9a4496f3fc8c89db0b9.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
ac7a29cb82b7b3e50d8aaa0da5e431f0b466de07dad241e5b6090cf71963e3b8.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
baa851154b7492b20ea71c068f77e7e2b91d347fb97e5e05999af153e3fd0f1f.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
bb5ca9d8de51734dbd14dc081c7c892d819cd14fafd7ccd62849d70f9e679369.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
c15e2ffa84d30fa17e9c61c19cde98b22ac6e259ec16b68a9927bed13a0aec07.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
c743ba08610d442531bb897a35748ba6fe897e730cea6e29377ba21141901326.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
cfda742c2de7706171af64a89806656a107069e1677aa4ce0583e696f954fde5.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
d1d74ec1039ff5aab99faf99bf70fb07f6b4c763a0c2fbc08b702ec9dcb03834.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
daa41f52309815eff99483c87788bfb56b8576f15eaad42cd5b06bb3cf0cccde.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral30
Sample
ed12ea76d03b8255f361975cebd5c579491dacc60c52e03373e7bf509523820a.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
f062577b6879fb42fbf7fef1c2a21f96d4d372f1424c1c77f255d13fb60bfae0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral32
Sample
f244a04265405ae8295551a1324c6dc3162d611b4a152658096d675a31a57d35.exe
Resource
win10v2004-20240709-en
General
-
Target
435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b.exe
-
Size
1.1MB
-
MD5
75ad544ceac0f47859e0f5417b950889
-
SHA1
5e4976f34abe798ec40087d4a4831e60040cd7dc
-
SHA256
435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b
-
SHA512
cd9b17097d4f3d878966ef3f6f8269db3cf96ae517d593b3521761de4ee0fc3b8c8a2e1f603b90ffe73f6426bd5648f9d2f0dbecf6904f96568909745cb9db95
-
SSDEEP
24576:BiIxSqmMEiPPHxXaUHtauiIxLmKPPH3paUS:NSqmKPvxqUHIOLmKPvgUS
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 444 2280 WerFault.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b.exe"C:\Users\Admin\AppData\Local\Temp\435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b.exe"1⤵PID:2280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 2162⤵
- Program crash
PID:444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2280 -ip 22801⤵PID:968
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=366A1028E87E637C33F10493E99E6212; domain=.bing.com; expires=Thu, 07-Aug-2025 11:13:49 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 10CDD11EB8C944A5BB2342B32F9CD977 Ref B: LON04EDGE1011 Ref C: 2024-07-13T11:13:49Z
date: Sat, 13 Jul 2024 11:13:49 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=366A1028E87E637C33F10493E99E6212
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=urFCRy_y_aA7jGKqIqmmVxc2Ve_GJFVMCHvN58JzOAk; domain=.bing.com; expires=Thu, 07-Aug-2025 11:13:49 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DF8B37F0D0FC47C197332E5F343D2D4F Ref B: LON04EDGE1011 Ref C: 2024-07-13T11:13:49Z
date: Sat, 13 Jul 2024 11:13:49 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=366A1028E87E637C33F10493E99E6212; MSPTC=urFCRy_y_aA7jGKqIqmmVxc2Ve_GJFVMCHvN58JzOAk
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2921CB32B01B4C289614FFA3DE7A6754 Ref B: LON04EDGE1011 Ref C: 2024-07-13T11:13:49Z
date: Sat, 13 Jul 2024 11:13:49 GMT
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.73.42.20.in-addr.arpaIN PTRResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=tls, http22.0kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=afcae927ee3a4f50b6df29986b6fb5cf&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
146 B 147 B 2 1
DNS Request
103.169.127.40.in-addr.arpa
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
25.73.42.20.in-addr.arpa