c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6

Analysis

max time kernel
95s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
Size

1.0MB
MD5

444f473f8a13b8b7761cc4c4bab32e70
SHA1

c3027bb285aa738ac1b213a782fcf4947a4f035d
SHA256

c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6
SHA512

9dc84eef18be75e6a1297a61f181127c95d154c11f57016368050f2286ecc2a30800568218aa869622ec98054adfbc9a221962f7a00619219ca7ea7f61a27502
SSDEEP

24576:A1wiUoFvNZ9lD9+f7vlK13BHUZ50zqLQyow3CqCzt:A1rhRNnlwf7dK11Ur0wQyow3Cpzt

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe

Executes dropped EXE 1 IoCs

pid	Process
4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
17	pastebin.com

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1204-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral2/files/0x000b000000023cb6-12.dat	upx
behavioral2/memory/4968-14-0x0000000000400000-0x000000000065C000-memory.dmp	upx

Program crash 19 IoCs

pid	pid_target	Process	procid_target
4524	4968	WerFault.exe	85
1364	4968	WerFault.exe	85
3852	4968	WerFault.exe	85
4796	4968	WerFault.exe	85
2836	4968	WerFault.exe	85
636	4968	WerFault.exe	85
4072	4968	WerFault.exe	85
2932	4968	WerFault.exe	85
4204	4968	WerFault.exe	85
2888	4968	WerFault.exe	85
228	4968	WerFault.exe	85
2336	4968	WerFault.exe	85
1764	4968	WerFault.exe	85
3376	4968	WerFault.exe	85
3660	4968	WerFault.exe	85
2492	4968	WerFault.exe	85
3444	4968	WerFault.exe	85
800	4968	WerFault.exe	85
1480	4968	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1204	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1204	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4968	1204	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	85
PID 1204 wrote to memory of 4968	1204	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	85
PID 1204 wrote to memory of 4968	1204	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	85
PID 4968 wrote to memory of 4300	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	86
PID 4968 wrote to memory of 4300	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	86
PID 4968 wrote to memory of 4300	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	86
PID 4968 wrote to memory of 1964	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	88
PID 4968 wrote to memory of 1964	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	88
PID 4968 wrote to memory of 1964	4968	c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe	88
PID 1964 wrote to memory of 2320	1964	cmd.exe	91
PID 1964 wrote to memory of 2320	1964	cmd.exe	91
PID 1964 wrote to memory of 2320	1964	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
"C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
  C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe" /TN qLmVomTF8d4e /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN qLmVomTF8d4e > C:\Users\Admin\AppData\Local\Temp\5FOem.xml
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN qLmVomTF8d4e
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 600
    3⤵
    - Program crash
    PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 648
    3⤵
    - Program crash
    PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 656
    3⤵
    - Program crash
    PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 736
    3⤵
    - Program crash
    PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 736
    3⤵
    - Program crash
    PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 760
    3⤵
    - Program crash
    PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1492
    3⤵
    - Program crash
    PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1496
    3⤵
    - Program crash
    PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1748
    3⤵
    - Program crash
    PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1536
    3⤵
    - Program crash
    PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1584
    3⤵
    - Program crash
    PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1580
    3⤵
    - Program crash
    PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1592
    3⤵
    - Program crash
    PID:1764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1740
    3⤵
    - Program crash
    PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1804
    3⤵
    - Program crash
    PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1840
    3⤵
    - Program crash
    PID:2492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1748
    3⤵
    - Program crash
    PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1812
    3⤵
    - Program crash
    PID:800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1464
    3⤵
    - Program crash
    PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4968 -ip 4968
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4968 -ip 4968
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4968 -ip 4968
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4968 -ip 4968
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4968 -ip 4968
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4968 -ip 4968
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4968 -ip 4968
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4968 -ip 4968
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4968 -ip 4968
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4968 -ip 4968
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4968 -ip 4968
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4968 -ip 4968
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4968 -ip 4968
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4968 -ip 4968
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4968 -ip 4968
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4968 -ip 4968
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4968 -ip 4968
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4968 -ip 4968
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4968 -ip 4968
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5FOem.xml

Filesize
1KB

MD5
3cb2dddb2a67c6c64f6ae107c8fa8526

SHA1
45a5f9206342446f6e6584841fed77894f94abed

SHA256
0fb75dc06244a98affd9696cd33b2c13388cda41999076e82ff5385445333209

SHA512
a576c70414630aaf19c24c06b4fb80402edfd15e83e1efeacc3905d7533f3f80b96a8b036e40595e38aa7f9981b30bf4a489b7563721c2f5415544b4a150acf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9fafbfecb58ea7ca23a6891294088d93d0dcc7f3eb8b444f186221777ee8ca6N.exe

Filesize
1.0MB

MD5
8d297cb721c975a74575625b4af92d9c

SHA1
874b4a3b37790571371dd8b563bfe9a94a0f2a1e

SHA256
6131e7df229fd08a9c8e5af450853e6288aa9965b995aba53aa0f7e5e4f72a9c

SHA512
90f8bfc6d643776bf6c8dfa803a3bba3c170ba8634a1c541352f240d8db0440eebbb66e67fdd1b70822928cad8be4af69450edabb62a0cb04afca54903f71ae4

Download Submit
memory/1204-0-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/1204-7-0x0000000024FF0000-0x000000002506E000-memory.dmp

Filesize
504KB

Download
memory/1204-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1204-13-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4968-14-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/4968-21-0x0000000023FB0000-0x000000002402E000-memory.dmp

Filesize
504KB

Download
memory/4968-22-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4968-27-0x00000000004B0000-0x000000000051B000-memory.dmp

Filesize
428KB

Download
memory/4968-44-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads