e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277

General

Target

e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
Size

1.1MB
MD5

2dc305316d9fb53c8231aedf503bc091
SHA1

ed6d688612ae7c69f7b514700ca0278e152adece
SHA256

e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277
SHA512

14c8c3023dab7c73a10227691d97142b4bf7f965771558005532aa1ce57a64d9fb93fe3421af4fe1bf46d6ab362fd07a1f109649eb5622b93d46dd3862c46046
SSDEEP

24576:hN+7LsvYOWMHVgWW22csmfI3RyqLa/ZSoa/JXekh77Lv+fh:Q4vYW1BFpWMwgTg4khb+

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3760	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Executes dropped EXE 1 IoCs

pid	Process
3760	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
19	pastebin.com

Program crash 16 IoCs

pid	pid_target	Process	procid_target
2668	1896	WerFault.exe	83
4048	3760	WerFault.exe	91
5012	3760	WerFault.exe	91
4924	3760	WerFault.exe	91
3244	3760	WerFault.exe	91
2784	3760	WerFault.exe	91
3484	3760	WerFault.exe	91
3680	3760	WerFault.exe	91
4616	3760	WerFault.exe	91
508	3760	WerFault.exe	91
1364	3760	WerFault.exe	91
3352	3760	WerFault.exe	91
1448	3760	WerFault.exe	91
2416	3760	WerFault.exe	91
2724	3760	WerFault.exe	91
508	3760	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3760	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
3760	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1896	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3760	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3760	1896	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe	91
PID 1896 wrote to memory of 3760	1896	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe	91
PID 1896 wrote to memory of 3760	1896	e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe	91

C:\Users\Admin\AppData\Local\Temp\e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
"C:\Users\Admin\AppData\Local\Temp\e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 344
  2⤵
  - Program crash
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
  C:\Users\Admin\AppData\Local\Temp\e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 344
    3⤵
    - Program crash
    PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 628
    3⤵
    - Program crash
    PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 664
    3⤵
    - Program crash
    PID:4924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 692
    3⤵
    - Program crash
    PID:3244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 656
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 900
    3⤵
    - Program crash
    PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1396
    3⤵
    - Program crash
    PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1452
    3⤵
    - Program crash
    PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1636
    3⤵
    - Program crash
    PID:508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1468
    3⤵
    - Program crash
    PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1408
    3⤵
    - Program crash
    PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1672
    3⤵
    - Program crash
    PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1696
    3⤵
    - Program crash
    PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1448
    3⤵
    - Program crash
    PID:2724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 644
    3⤵
    - Program crash
    PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1896 -ip 1896
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3760 -ip 3760
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3760 -ip 3760
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3760 -ip 3760
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3760 -ip 3760
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3760 -ip 3760
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3760 -ip 3760
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3760 -ip 3760
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3760 -ip 3760
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3760 -ip 3760
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3760 -ip 3760
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3760 -ip 3760
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3760 -ip 3760
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3760 -ip 3760
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e8e090dd9354d8adb2e1453843e213bb4acd74fc331f0bab2bd57f7a2880d277.exe

Filesize
1.1MB

MD5
405b5c33a85a750ec816982ad1d1f9e1

SHA1
3a223d6cdc87bdf603589866a1afbffbb448c9ce

SHA256
6fc8d515e891b609893723a13a0a339106f8696be6e5d11b029c52145cccf167

SHA512
1ddaf7c30932d65608e036c1e8f535c78fc931a7f59243cddd4a9ce6c73377648508a25c4f217746972cb7cccd27a37558f773f05fe047a757f064877ca58d38

Download Submit
memory/1896-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1896-7-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/3760-6-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/3760-14-0x0000000005160000-0x0000000005277000-memory.dmp

Filesize
1.1MB

Download
memory/3760-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3760-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3760-27-0x000000000BA00000-0x000000000BAA3000-memory.dmp

Filesize
652KB

Download

Analysis

Sharing