a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82

General

Target

a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
Size

1.1MB
MD5

f7dea9fb29374fa817700d1e720647e0
SHA1

cfa698f0becb0c2789c75f1ac584045517809137
SHA256

a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82
SHA512

fbd65c4625b5b6924f9d5f71a1beaca805cac95ae348028c8ffd5cc59156b42cb1939e7b63b4462d50d3b0bc73f9528a7c52bfcc83741d9f44ce296e92c8160e
SSDEEP

24576:saGaUtrc7LmC5X3Y1qZsfGnceEP2VV/e2Wa/ZSoa/JXRP8lI:wFqmClo1qZsX+wg/gfP8lI

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1540	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Executes dropped EXE 1 IoCs

pid	Process
1540	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
15	pastebin.com

Program crash 14 IoCs

pid	pid_target	Process	procid_target
540	2140	WerFault.exe	82
4428	1540	WerFault.exe	90
3872	1540	WerFault.exe	90
5028	1540	WerFault.exe	90
2452	1540	WerFault.exe	90
4832	1540	WerFault.exe	90
1592	1540	WerFault.exe	90
3568	1540	WerFault.exe	90
5080	1540	WerFault.exe	90
3948	1540	WerFault.exe	90
2376	1540	WerFault.exe	90
2432	1540	WerFault.exe	90
1504	1540	WerFault.exe	90
1052	1540	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
1540	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2140	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1540	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1540	2140	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe	90
PID 2140 wrote to memory of 1540	2140	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe	90
PID 2140 wrote to memory of 1540	2140	a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe	90

C:\Users\Admin\AppData\Local\Temp\a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
"C:\Users\Admin\AppData\Local\Temp\a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 344
  2⤵
  - Program crash
  PID:540
- C:\Users\Admin\AppData\Local\Temp\a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
  C:\Users\Admin\AppData\Local\Temp\a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 344
    3⤵
    - Program crash
    PID:4428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 628
    3⤵
    - Program crash
    PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 636
    3⤵
    - Program crash
    PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 680
    3⤵
    - Program crash
    PID:2452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 720
    3⤵
    - Program crash
    PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 900
    3⤵
    - Program crash
    PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1408
    3⤵
    - Program crash
    PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1448
    3⤵
    - Program crash
    PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1492
    3⤵
    - Program crash
    PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1480
    3⤵
    - Program crash
    PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1520
    3⤵
    - Program crash
    PID:2432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1512
    3⤵
    - Program crash
    PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1472
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2140 -ip 2140
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1540 -ip 1540
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1540 -ip 1540
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1540 -ip 1540
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1540 -ip 1540
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1540 -ip 1540
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1540 -ip 1540
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1540 -ip 1540
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1540 -ip 1540
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1540 -ip 1540
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1540 -ip 1540
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1540 -ip 1540
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1540 -ip 1540
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1540 -ip 1540
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a0da20e17b7ca75e821d96af1ff8a47ef0c72797bee26514c395168bae172f82N.exe

Filesize
1.1MB

MD5
5fbfeb70d6dd95646c87b3be77460012

SHA1
b4e828b6b82fd9ffd7ad9a8a4f230c0d5849630c

SHA256
8940c47b3225e42c593fcf0dbeced13d97ae3ffeb3c91c627919c138d82b37fe

SHA512
47c28b45bf94a17d4690d60873021a7f459dd47de02b50385b3f2cba2989a93bb7f73a787780416e31639f5eb2f31f70e704d426d89fa1afe6afd608eb3a6f7d

Download Submit
memory/1540-6-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1540-8-0x0000000005040000-0x0000000005158000-memory.dmp

Filesize
1.1MB

Download
memory/1540-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1540-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1540-27-0x000000000B9E0000-0x000000000BA83000-memory.dmp

Filesize
652KB

Download
memory/1540-28-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2140-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2140-7-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing