7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02

General

Target
7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
Size 896KB
Sample241109-3vb9lavdkr
SHA256 7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02
MD5 72f94ced8ad2dce78375cbe7ac9a51d5
SHA1 8a2351c59025fe8622eb82868e316d042c4139a0
SHA512 9265485b31b6da4ac6c9bb7d6d87b5c638c83b32f670b8ac1570d74614565a567b9fb81f04cdb0514a0315e4d4c7f70444ad689f821b3723ebda71dc9144c5ad
SSDEEP 24576:DTRVnYW5fFEUxhouPdGyDjozx9/jUruRa/sTK:7F5xhpkyXg9/joQgsK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2568	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	pastebin.com
15	pastebin.com

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4120	2992	WerFault.exe	82
3676	2568	WerFault.exe	89
3612	2568	WerFault.exe	89
2804	2568	WerFault.exe	89
2848	2568	WerFault.exe	89
2616	2568	WerFault.exe	89
5052	2568	WerFault.exe	89
2336	2568	WerFault.exe	89
1072	2568	WerFault.exe	89
1416	2568	WerFault.exe	89
1944	2568	WerFault.exe	89
3592	2568	WerFault.exe	89
2372	2568	WerFault.exe	89
3472	2568	WerFault.exe	89
4440	2568	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
2568	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2992	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2568	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2568	2992	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe	89
PID 2992 wrote to memory of 2568	2992	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe	89
PID 2992 wrote to memory of 2568	2992	7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe	89

C:\Users\Admin\AppData\Local\Temp\7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
"C:\Users\Admin\AppData\Local\Temp\7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 276
  2⤵
  - Program crash
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
  C:\Users\Admin\AppData\Local\Temp\7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 352
    3⤵
    - Program crash
    PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 616
    3⤵
    - Program crash
    PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 660
    3⤵
    - Program crash
    PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 672
    3⤵
    - Program crash
    PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 720
    3⤵
    - Program crash
    PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 920
    3⤵
    - Program crash
    PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1396
    3⤵
    - Program crash
    PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1464
    3⤵
    - Program crash
    PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1492
    3⤵
    - Program crash
    PID:1416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1468
    3⤵
    - Program crash
    PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1516
    3⤵
    - Program crash
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1496
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1400
    3⤵
    - Program crash
    PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 652
    3⤵
    - Program crash
    PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2992 -ip 2992
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2568 -ip 2568
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2568 -ip 2568
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2568 -ip 2568
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2568 -ip 2568
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2568 -ip 2568
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2568 -ip 2568
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2568 -ip 2568
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2568 -ip 2568
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2568 -ip 2568
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2568 -ip 2568
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2568 -ip 2568
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2568 -ip 2568
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2568 -ip 2568
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2568 -ip 2568
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe

Path C:\Users\Admin\AppData\Local\Temp\7cc7b55b71389329d3fea6f47ed9ccb5c3b994eaa0480a789e354eeb6daaec02.exe
Size 896KB
SHA256 21f38eb13ec5d1167c3baf0fa0191dbda8ed207c4d8a2d5d840331c4e9c62695
MD5 b3be03009a88952b6cf09a8725fe8c1b
SHA1 e245e2c8b3d9f14f5171c9168e8098082ce45088
SHA512 d5394483c5c8d574126f1218e14619e3247f771a807e7e994d84216af2a187081824705474587116924be8456b23cbe8fd88901958bcbd01e9807b4096af1f34
SSDEEP 24576:vXjN3BFMsW1xFDWuBmOCPsO9khxIa/sTK:/jNxFML17DWOCPsJcgsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-7-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/2568-8-0x0000000005080000-0x0000000005169000-memory.dmp

Download

memory/2568-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2568-27-0x000000000B9C0000-0x000000000BA63000-memory.dmp

Download

memory/2568-21-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2568-28-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/2992-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/2992-6-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads