59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59

General

Target

59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
Size

988KB
MD5

5cc95c47beea902404f58ec7bf3e4bf0
SHA1

80132e618fb5da5ef03965405d6808f9ba6df8c5
SHA256

59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59
SHA512

20fb19c8a969420e90e365c00b6b29e8ddfac22774186deb5cf82931712f4cc27bdd01a6bf37e8a8102209e73b6b32c9fcaa1a353383b007f2ed6e25540df27c
SSDEEP

24576:uZxkG5b/nenk3su45PctcUp1mQBAi2ZrZ3Wd5Xa/ZS6o77LQdmbgrr:uLkG5Lnenk3su45PctcUp1mQ4rZ3Wd5i

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1012	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Executes dropped EXE 1 IoCs

pid	Process
1012	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
11	pastebin.com

Program crash 14 IoCs

pid	pid_target	Process	procid_target
3724	3720	WerFault.exe	81
3120	1012	WerFault.exe	86
1836	1012	WerFault.exe	86
2260	1012	WerFault.exe	86
2080	1012	WerFault.exe	86
1436	1012	WerFault.exe	86
1492	1012	WerFault.exe	86
3356	1012	WerFault.exe	86
3156	1012	WerFault.exe	86
1804	1012	WerFault.exe	86
2700	1012	WerFault.exe	86
2640	1012	WerFault.exe	86
1396	1012	WerFault.exe	86
4628	1012	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
1012	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3720	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1012	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1012	3720	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe	86
PID 3720 wrote to memory of 1012	3720	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe	86
PID 3720 wrote to memory of 1012	3720	59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe	86

C:\Users\Admin\AppData\Local\Temp\59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
"C:\Users\Admin\AppData\Local\Temp\59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 344
  2⤵
  - Program crash
  PID:3724
- C:\Users\Admin\AppData\Local\Temp\59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
  C:\Users\Admin\AppData\Local\Temp\59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 344
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 620
    3⤵
    - Program crash
    PID:1836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 648
    3⤵
    - Program crash
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 692
    3⤵
    - Program crash
    PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 708
    3⤵
    - Program crash
    PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 884
    3⤵
    - Program crash
    PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1396
    3⤵
    - Program crash
    PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1472
    3⤵
    - Program crash
    PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1444
    3⤵
    - Program crash
    PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1412
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1684
    3⤵
    - Program crash
    PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1444
    3⤵
    - Program crash
    PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1064
    3⤵
    - Program crash
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3720 -ip 3720
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1012 -ip 1012
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1012 -ip 1012
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1012 -ip 1012
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1012 -ip 1012
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1012 -ip 1012
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1012 -ip 1012
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1012 -ip 1012
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1012 -ip 1012
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1012 -ip 1012
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1012 -ip 1012
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1012 -ip 1012
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1012 -ip 1012
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1012 -ip 1012
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\59dc640ffa99ad1da961df8cc243a5d0c193cfa99d6a9c7b35107bec3c89ec59N.exe

Filesize
988KB

MD5
8e53ce604e54071306e862284415560c

SHA1
54e5865d4b50cae01e6d3ea1342809b532224c0a

SHA256
ca5ed5cf0d387413b8841f60bc507c42815dd6e4dc58a215be8d31d24085d795

SHA512
c2376c019959240235fd1f26a7e8f74ee1fb270f1e8b6255ad648d7f60393db3131798a0ec9262d5d8967e736c6a854f8756fa0c4ca526bdd638baa2e700b584

Download Submit
memory/1012-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1012-8-0x0000000004FB0000-0x000000000509F000-memory.dmp

Filesize
956KB

Download
memory/1012-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1012-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1012-27-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Filesize
652KB

Download
memory/1012-28-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3720-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3720-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing