98c722526980af2b4915f7b22cb1aeb51a57b5a517642dae952fcc49f34a2628

General

Target

af5a206750a5fb8bb181e6733f2450a0N.exe
Size

1.2MB
MD5

af5a206750a5fb8bb181e6733f2450a0
SHA1

73f8fede00769661fae87e555c7a289a76370254
SHA256

98c722526980af2b4915f7b22cb1aeb51a57b5a517642dae952fcc49f34a2628
SHA512

34ba5c8081a6de7d36e394c4fb0abd1284238bbb69a937cc092e3cbcb00a7508a505a0ddd19c907c4a78a8ff4cda01e28d9e7637034d945c6c60d3fc9510c3e6
SSDEEP

24576:Y2U35IgezjL9kjRuTgmbd3XXRlLWa/ZSba/JXUZkjdC77Lv+f6T8YnGoh:Y2UgLWjRuzbd3HrLWgkgGuj4bNnGoh

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5064	af5a206750a5fb8bb181e6733f2450a0N.exe

Executes dropped EXE 1 IoCs

pid	Process
5064	af5a206750a5fb8bb181e6733f2450a0N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	pastebin.com
26	pastebin.com

Program crash 14 IoCs

pid	pid_target	Process	procid_target
1904	5084	WerFault.exe	82
4520	5064	WerFault.exe	92
4144	5064	WerFault.exe	92
2892	5064	WerFault.exe	92
2968	5064	WerFault.exe	92
3932	5064	WerFault.exe	92
2312	5064	WerFault.exe	92
844	5064	WerFault.exe	92
1192	5064	WerFault.exe	92
400	5064	WerFault.exe	92
3964	5064	WerFault.exe	92
4540	5064	WerFault.exe	92
1712	5064	WerFault.exe	92
3936	5064	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af5a206750a5fb8bb181e6733f2450a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5064	af5a206750a5fb8bb181e6733f2450a0N.exe
5064	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5084	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5064	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5064	5084	af5a206750a5fb8bb181e6733f2450a0N.exe	92
PID 5084 wrote to memory of 5064	5084	af5a206750a5fb8bb181e6733f2450a0N.exe	92
PID 5084 wrote to memory of 5064	5084	af5a206750a5fb8bb181e6733f2450a0N.exe	92

C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
"C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 344
  2⤵
  - Program crash
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
  C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 344
    3⤵
    - Program crash
    PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 628
    3⤵
    - Program crash
    PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 636
    3⤵
    - Program crash
    PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 636
    3⤵
    - Program crash
    PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 656
    3⤵
    - Program crash
    PID:3932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 916
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1404
    3⤵
    - Program crash
    PID:844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1456
    3⤵
    - Program crash
    PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1472
    3⤵
    - Program crash
    PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1456
    3⤵
    - Program crash
    PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1468
    3⤵
    - Program crash
    PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1472
    3⤵
    - Program crash
    PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1692
    3⤵
    - Program crash
    PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5064 -ip 5064
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5064 -ip 5064
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5064 -ip 5064
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5064 -ip 5064
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5064 -ip 5064
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5064 -ip 5064
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5064 -ip 5064
1⤵
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5064 -ip 5064
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5064 -ip 5064
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5064 -ip 5064
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5064 -ip 5064
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5064 -ip 5064
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5064 -ip 5064
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe

Filesize
1.2MB

MD5
81ef176e966865d9a7f9522e36a8b531

SHA1
eb641b4702633b195015058dbd00571a024854c4

SHA256
a06e5f8341f5792bd46eeda10099ceee3b58e39b805d5df09387ebb02acb8ea9

SHA512
724d31f7078432adeb796147fdce5e54f9bda44b4dc32aba84b522b72bacb7d9e859b186f64b366b48102e32dd6591a9f12319faf5a9b028548155ac6a951117

Download Submit
memory/5064-7-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/5064-8-0x00000000050A0000-0x00000000051BA000-memory.dmp

Filesize
1.1MB

Download
memory/5064-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/5064-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5064-27-0x000000000B9D0000-0x000000000BA73000-memory.dmp

Filesize
652KB

Download
memory/5064-28-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/5084-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/5084-6-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing