e801a02936cc0ef8402db5e94f54adc186a7162e155ae2928b04645ef87ca771

General

Target

e64761a1f5ad58e785abaeca605bd590N.exe
Size

1.9MB
MD5

e64761a1f5ad58e785abaeca605bd590
SHA1

2ed1b728d51aa964a77cb3d4729b6c36947df167
SHA256

e801a02936cc0ef8402db5e94f54adc186a7162e155ae2928b04645ef87ca771
SHA512

42d331f4a209635cfcf666207ef52b12fb540b129f7634be1a829d1310d2638cb049cc363047f2097125dd1e05fd71fc4dac0ebc17cccebafe3d9bebc0ad530b
SSDEEP

24576:39kSEuzft2Fe9uK+uj/kqg3xmULKa/ZSoa/JXekh77Lv+f6T8gsihEChlUu+0:39xQFS+urk9xmULKgTg4khbNsm+0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1848	e64761a1f5ad58e785abaeca605bd590N.exe

Executes dropped EXE 1 IoCs

pid	Process
1848	e64761a1f5ad58e785abaeca605bd590N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
15	pastebin.com

Program crash 14 IoCs

pid	pid_target	Process	procid_target
4820	1828	WerFault.exe	82
1976	1848	WerFault.exe	90
2804	1848	WerFault.exe	90
3156	1848	WerFault.exe	90
4560	1848	WerFault.exe	90
5100	1848	WerFault.exe	90
452	1848	WerFault.exe	90
4500	1848	WerFault.exe	90
1752	1848	WerFault.exe	90
3540	1848	WerFault.exe	90
1104	1848	WerFault.exe	90
3788	1848	WerFault.exe	90
3012	1848	WerFault.exe	90
3680	1848	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e64761a1f5ad58e785abaeca605bd590N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e64761a1f5ad58e785abaeca605bd590N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	e64761a1f5ad58e785abaeca605bd590N.exe
1848	e64761a1f5ad58e785abaeca605bd590N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1828	e64761a1f5ad58e785abaeca605bd590N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1848	e64761a1f5ad58e785abaeca605bd590N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1848	1828	e64761a1f5ad58e785abaeca605bd590N.exe	90
PID 1828 wrote to memory of 1848	1828	e64761a1f5ad58e785abaeca605bd590N.exe	90
PID 1828 wrote to memory of 1848	1828	e64761a1f5ad58e785abaeca605bd590N.exe	90

C:\Users\Admin\AppData\Local\Temp\e64761a1f5ad58e785abaeca605bd590N.exe
"C:\Users\Admin\AppData\Local\Temp\e64761a1f5ad58e785abaeca605bd590N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 344
  2⤵
  - Program crash
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\e64761a1f5ad58e785abaeca605bd590N.exe
  C:\Users\Admin\AppData\Local\Temp\e64761a1f5ad58e785abaeca605bd590N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 352
    3⤵
    - Program crash
    PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 628
    3⤵
    - Program crash
    PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 636
    3⤵
    - Program crash
    PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 636
    3⤵
    - Program crash
    PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 720
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 928
    3⤵
    - Program crash
    PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1420
    3⤵
    - Program crash
    PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1500
    3⤵
    - Program crash
    PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1516
    3⤵
    - Program crash
    PID:3540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1540
    3⤵
    - Program crash
    PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1576
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1496
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1580
    3⤵
    - Program crash
    PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1828 -ip 1828
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1848 -ip 1848
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1848 -ip 1848
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1848 -ip 1848
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1848 -ip 1848
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1848 -ip 1848
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1848 -ip 1848
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1848 -ip 1848
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1848 -ip 1848
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1848 -ip 1848
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1848 -ip 1848
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1848 -ip 1848
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1848 -ip 1848
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1848 -ip 1848
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e64761a1f5ad58e785abaeca605bd590N.exe

Filesize
1.9MB

MD5
b82e49f808df0c30580bfad38d3c829f

SHA1
f2f1fc7353014782f0ee5ac21a98a5ca9cd6d989

SHA256
7a83bb0bb4c545b9d00058d302ecc5e911caa401475d87f7eff4864c63a534df

SHA512
1753d7cbb7ab6d0f02930554d69a9c29154015827212aa1c62b868c3ba226969fd6d17b52b343373d8cbfbd9707d71b657eac3e8b649ba323accc48ad38e029d

Download Submit
memory/1828-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1828-6-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1848-7-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1848-8-0x00000000050E0000-0x00000000051F7000-memory.dmp

Filesize
1.1MB

Download
memory/1848-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1848-27-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Filesize
652KB

Download
memory/1848-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1848-28-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing