Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
570ea4bf0c07e1e6ee8e350611aef160N.exe
Resource
win7-20240903-en
General
-
Target
570ea4bf0c07e1e6ee8e350611aef160N.exe
-
Size
324KB
-
MD5
570ea4bf0c07e1e6ee8e350611aef160
-
SHA1
59e54afdd82fd18c65854981a738c2d192cda8b6
-
SHA256
82bb3ca37dc71eaa8e41ce63b437b30fb4ca1e5df49837d77b5f8e8ba6f2ba33
-
SHA512
2d7b8628944ecba398e5930a374b9256b8b21ca32cb6c59981707f5499b2004904b1c2f09bb79b3a56c5e0e29f452f34728b3224abb5907d527060eb347c02fc
-
SSDEEP
6144:TfbDrty9JbmIgP6eP+fKtuol4gWeTjqmF/Q:jb/ty9JmV0ml4gJ68/
Malware Config
Extracted
gcleaner
80.66.75.114
45.91.200.135
Signatures
-
Downloads MZ/PE file
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3208 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 3184 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 1836 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 232 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 3308 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 2644 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 2804 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe 668 4816 WerFault.exe 570ea4bf0c07e1e6ee8e350611aef160N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
570ea4bf0c07e1e6ee8e350611aef160N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570ea4bf0c07e1e6ee8e350611aef160N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\570ea4bf0c07e1e6ee8e350611aef160N.exe"C:\Users\Admin\AppData\Local\Temp\570ea4bf0c07e1e6ee8e350611aef160N.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 4522⤵
- Program crash
PID:3208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 5002⤵
- Program crash
PID:3184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7482⤵
- Program crash
PID:1836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7682⤵
- Program crash
PID:232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7482⤵
- Program crash
PID:3308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8402⤵
- Program crash
PID:2644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9122⤵
- Program crash
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9842⤵
- Program crash
PID:668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4816 -ip 48161⤵PID:2816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4816 -ip 48161⤵PID:672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4816 -ip 48161⤵PID:2408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4816 -ip 48161⤵PID:3008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4816 -ip 48161⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4816 -ip 48161⤵PID:980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4816 -ip 48161⤵PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4816 -ip 48161⤵PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99