b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2

General

Target

b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
Size

1004KB
MD5

b2c7e470722d7551f9b65f5c02fb8e50
SHA1

6d181aba79a8477f08e4fa18eb1211061e0e0bc9
SHA256

b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2
SHA512

87314ee4367a82daf71f02e0c65233c8e0a9c088ad8ff6db8b0f3e4c5fc6e7cac505adeaf520b8ee133591a2499fd2dba4605eacddf33f96a4051097fd3efc57
SSDEEP

12288:YjagpagWRYmHAc2bpINtxvR7NhxHG9y7Z4ZRaru9s5iu2UbxioVBtujVDa/ZSCB8:YjFpgL2KtxS9y7Ka3sI6a/ZSCBHn677

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2824	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Executes dropped EXE 1 IoCs

pid	Process
2824	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	pastebin.com
17	pastebin.com

Program crash 14 IoCs

pid	pid_target	Process	procid_target
2240	688	WerFault.exe	82
4828	2824	WerFault.exe	90
4440	2824	WerFault.exe	90
4084	2824	WerFault.exe	90
2736	2824	WerFault.exe	90
4592	2824	WerFault.exe	90
2988	2824	WerFault.exe	90
2276	2824	WerFault.exe	90
2688	2824	WerFault.exe	90
2892	2824	WerFault.exe	90
3584	2824	WerFault.exe	90
1528	2824	WerFault.exe	90
1268	2824	WerFault.exe	90
1652	2824	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
2824	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
688	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2824	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2824	688	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe	90
PID 688 wrote to memory of 2824	688	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe	90
PID 688 wrote to memory of 2824	688	b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe	90

C:\Users\Admin\AppData\Local\Temp\b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
"C:\Users\Admin\AppData\Local\Temp\b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 352
  2⤵
  - Program crash
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
  C:\Users\Admin\AppData\Local\Temp\b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 344
    3⤵
    - Program crash
    PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 628
    3⤵
    - Program crash
    PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 628
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 628
    3⤵
    - Program crash
    PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 728
    3⤵
    - Program crash
    PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 904
    3⤵
    - Program crash
    PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1408
    3⤵
    - Program crash
    PID:2276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1456
    3⤵
    - Program crash
    PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1472
    3⤵
    - Program crash
    PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1524
    3⤵
    - Program crash
    PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1460
    3⤵
    - Program crash
    PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1480
    3⤵
    - Program crash
    PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1532
    3⤵
    - Program crash
    PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 688 -ip 688
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2824 -ip 2824
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2824 -ip 2824
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2824 -ip 2824
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2824 -ip 2824
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2824 -ip 2824
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2824 -ip 2824
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2824 -ip 2824
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2824 -ip 2824
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2824 -ip 2824
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2824 -ip 2824
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2824 -ip 2824
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2824 -ip 2824
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2824 -ip 2824
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b3fa5a79f8fe6d79aa291d605e5a521e292af6ac8123ff25253e939ee07ce0b2N.exe

Filesize
1004KB

MD5
9475560168e1b71765c939269ca90998

SHA1
d8a17f494e291f22c957b151469b3e9a74868332

SHA256
029009ad8ed9e21349a114d16e16df8fde3c9182617cd7753ca67bc4f38c4025

SHA512
a90cd18c378bf7af003cd89605ffac868c221736cdf45b137ae07252a69830d5c085a1fb1406fbfcb57a986262680d06a48f5bf0d38a7d462116214623e8d696

Download Submit
memory/688-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/688-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2824-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2824-8-0x0000000005040000-0x000000000512F000-memory.dmp

Filesize
956KB

Download
memory/2824-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2824-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-27-0x000000000B9F0000-0x000000000BA93000-memory.dmp

Filesize
652KB

Download
memory/2824-28-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing