28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637

General

Target

28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
Size

276KB
MD5

fe559e673d14f05af4fd51191ffc31fb
SHA1

ff79f669f4dd143ef33094d087e6c289ef43a588
SHA256

28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637
SHA512

c7bfdebc6c5adea21387d3219a52b4b59c225b518a97bafbcad73df7c327cc03321b6a33d8b19a5b461cbc00ef43c14e3429c913b5ca49543d5e4156a79ecee9
SSDEEP

6144:+8o6mYd/c76QjwExcJHg2r2Nh/qoWV0gh4bmIfQYh3912rBY9wd:+81mm/OwExcJHZr2Nh/vWV0xNfd391y7

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 set thread context of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4308	864	WerFault.exe	83
2596	5072	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 864	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	83
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84
PID 3000 wrote to memory of 5072	3000	28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe	84

C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
"C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
  C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
  2⤵
  PID:864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 80
    3⤵
    - Program crash
    PID:4308
- C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
  C:\Users\Admin\AppData\Local\Temp\28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637.exe
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 80
    3⤵
    - Program crash
    PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 864 -ip 864
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5072 -ip 5072
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000000750000-0x000000000079A000-memory.dmp

Filesize
296KB

Download
memory/3000-2-0x0000000004FF0000-0x0000000005048000-memory.dmp

Filesize
352KB

Download
memory/3000-3-0x0000000007630000-0x00000000076CC000-memory.dmp

Filesize
624KB

Download
memory/3000-4-0x0000000007C80000-0x0000000008224000-memory.dmp

Filesize
5.6MB

Download
memory/3000-5-0x00000000076D0000-0x0000000007762000-memory.dmp

Filesize
584KB

Download
memory/3000-6-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/3000-10-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing