Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 16:50
Static task
static1
Behavioral task
behavioral1
Sample
murofet_0.0.0.5.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
murofet_0.0.0.5.vir.exe
Resource
win10
General
-
Target
murofet_0.0.0.5.vir.exe
-
Size
160KB
-
MD5
a6b4b6bb07cf1e7dd6e352f98b07a872
-
SHA1
b9c25407e93420b4cdce9b5f8d2a971038aee47a
-
SHA256
8c9087b9e6af76699ab0777535b2e99c4a345f6d4714953604367adfc4a8f7c1
-
SHA512
d4e05f52b1c818950e404622539d2b7655d9d392aa101a9cf955c3c0f6d030748f224dbf8e946492b04c3218e96ade51f3a83fe0521f65cb8b0eae2ff899204f
Malware Config
Signatures
-
Processes:
murofet_0.0.0.5.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy murofet_0.0.0.5.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" murofet_0.0.0.5.vir.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\4AA00FE1-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
murofet_0.0.0.5.vir.exeqoum.exepid process 1412 murofet_0.0.0.5.vir.exe 1412 murofet_0.0.0.5.vir.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe 1464 qoum.exe -
Loads dropped DLL 1 IoCs
Processes:
murofet_0.0.0.5.vir.exepid process 1412 murofet_0.0.0.5.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
qoum.exepid process 1464 qoum.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
murofet_0.0.0.5.vir.exedescription pid process target process PID 1412 set thread context of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1920 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
qoum.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run qoum.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{93CA6935-29D7-371B-5DE1-A0ED10856407} = "C:\\Users\\Admin\\AppData\\Roaming\\Cuwemu\\qoum.exe" qoum.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
murofet_0.0.0.5.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1412 murofet_0.0.0.5.vir.exe Token: SeSecurityPrivilege 1412 murofet_0.0.0.5.vir.exe Token: SeSecurityPrivilege 1412 murofet_0.0.0.5.vir.exe Token: SeManageVolumePrivilege 604 WinMail.exe -
Suspicious use of WriteProcessMemory 106 IoCs
Processes:
murofet_0.0.0.5.vir.exeqoum.exedescription pid process target process PID 1412 wrote to memory of 1464 1412 murofet_0.0.0.5.vir.exe qoum.exe PID 1412 wrote to memory of 1464 1412 murofet_0.0.0.5.vir.exe qoum.exe PID 1412 wrote to memory of 1464 1412 murofet_0.0.0.5.vir.exe qoum.exe PID 1412 wrote to memory of 1464 1412 murofet_0.0.0.5.vir.exe qoum.exe PID 1464 wrote to memory of 1152 1464 qoum.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 qoum.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 qoum.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 qoum.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 qoum.exe taskhost.exe PID 1464 wrote to memory of 1232 1464 qoum.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 qoum.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 qoum.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 qoum.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 qoum.exe Dwm.exe PID 1464 wrote to memory of 1296 1464 qoum.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 qoum.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 qoum.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 qoum.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 qoum.exe Explorer.EXE PID 1464 wrote to memory of 1412 1464 qoum.exe murofet_0.0.0.5.vir.exe PID 1464 wrote to memory of 1412 1464 qoum.exe murofet_0.0.0.5.vir.exe PID 1464 wrote to memory of 1412 1464 qoum.exe murofet_0.0.0.5.vir.exe PID 1464 wrote to memory of 1412 1464 qoum.exe murofet_0.0.0.5.vir.exe PID 1464 wrote to memory of 1412 1464 qoum.exe murofet_0.0.0.5.vir.exe PID 1464 wrote to memory of 604 1464 qoum.exe WinMail.exe PID 1464 wrote to memory of 604 1464 qoum.exe WinMail.exe PID 1464 wrote to memory of 604 1464 qoum.exe WinMail.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1412 wrote to memory of 1920 1412 murofet_0.0.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 616 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 616 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 616 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 616 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 616 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1128 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1128 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1128 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1128 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1128 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1092 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1092 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1092 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1092 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1092 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 764 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 764 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 764 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 764 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 764 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1840 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1840 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1840 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1840 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1840 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1884 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1884 1464 qoum.exe DllHost.exe PID 1464 wrote to memory of 1884 1464 qoum.exe DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\murofet_0.0.0.5.vir.exe"C:\Users\Admin\AppData\Local\Temp\murofet_0.0.0.5.vir.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Cuwemu\qoum.exe"C:\Users\Admin\AppData\Roaming\Cuwemu\qoum.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5de22c4e.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\Local\Temp\tmp5de22c4e.bat
-
C:\Users\Admin\AppData\Roaming\Cuwemu\qoum.exe
-
C:\Users\Admin\AppData\Roaming\Cuwemu\qoum.exe
-
C:\Users\Admin\AppData\Roaming\Yfhi\utuq.oby
-
\Users\Admin\AppData\Roaming\Cuwemu\qoum.exe
-
memory/604-29-0x0000000003FE0000-0x0000000003FE2000-memory.dmpFilesize
8KB
-
memory/604-32-0x00000000042E0000-0x00000000042E2000-memory.dmpFilesize
8KB
-
memory/604-8-0x00000000039B0000-0x0000000003AB0000-memory.dmpFilesize
1024KB
-
memory/604-9-0x00000000039B0000-0x0000000003BB0000-memory.dmpFilesize
2.0MB
-
memory/604-10-0x0000000003AB0000-0x0000000003BB0000-memory.dmpFilesize
1024KB
-
memory/604-14-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/604-15-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/604-16-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/604-17-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/604-18-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/604-19-0x0000000003BE0000-0x0000000003BE2000-memory.dmpFilesize
8KB
-
memory/604-20-0x0000000003E20000-0x0000000003E22000-memory.dmpFilesize
8KB
-
memory/604-21-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/604-22-0x0000000003BE0000-0x0000000003BE2000-memory.dmpFilesize
8KB
-
memory/604-23-0x0000000003E00000-0x0000000003E02000-memory.dmpFilesize
8KB
-
memory/604-24-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/604-25-0x0000000003EA0000-0x0000000003EA2000-memory.dmpFilesize
8KB
-
memory/604-26-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/604-27-0x0000000003FE0000-0x0000000003FE2000-memory.dmpFilesize
8KB
-
memory/604-28-0x0000000003BC0000-0x0000000003BC2000-memory.dmpFilesize
8KB
-
memory/604-4-0x00000000039B0000-0x0000000003AB0000-memory.dmpFilesize
1024KB
-
memory/604-30-0x0000000004150000-0x0000000004152000-memory.dmpFilesize
8KB
-
memory/604-31-0x0000000004400000-0x0000000004402000-memory.dmpFilesize
8KB
-
memory/604-6-0x00000000039B0000-0x0000000003BB0000-memory.dmpFilesize
2.0MB
-
memory/604-33-0x0000000003BC0000-0x0000000003BC2000-memory.dmpFilesize
8KB
-
memory/604-34-0x0000000004490000-0x0000000004492000-memory.dmpFilesize
8KB
-
memory/604-35-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/604-36-0x0000000004310000-0x0000000004312000-memory.dmpFilesize
8KB
-
memory/604-37-0x0000000004140000-0x0000000004142000-memory.dmpFilesize
8KB
-
memory/604-38-0x0000000004140000-0x0000000004142000-memory.dmpFilesize
8KB
-
memory/604-39-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/604-40-0x0000000003E00000-0x0000000003E02000-memory.dmpFilesize
8KB
-
memory/604-41-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/604-42-0x0000000003E70000-0x0000000003E72000-memory.dmpFilesize
8KB
-
memory/604-43-0x0000000003E30000-0x0000000003E32000-memory.dmpFilesize
8KB
-
memory/604-44-0x0000000003E80000-0x0000000003E82000-memory.dmpFilesize
8KB
-
memory/604-45-0x0000000003E90000-0x0000000003E92000-memory.dmpFilesize
8KB
-
memory/604-46-0x0000000004160000-0x0000000004162000-memory.dmpFilesize
8KB
-
memory/604-47-0x0000000004150000-0x0000000004152000-memory.dmpFilesize
8KB
-
memory/604-48-0x0000000002610000-0x0000000002612000-memory.dmpFilesize
8KB
-
memory/604-49-0x0000000003F10000-0x0000000003F12000-memory.dmpFilesize
8KB
-
memory/604-50-0x0000000004170000-0x0000000004172000-memory.dmpFilesize
8KB
-
memory/604-51-0x00000000039B0000-0x0000000003AB0000-memory.dmpFilesize
1024KB
-
memory/604-53-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/604-59-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/1464-1-0x0000000000000000-mapping.dmp
-
memory/1920-65-0x0000000000050000-0x000000000007C000-memory.dmpFilesize
176KB
-
memory/1920-67-0x000000000006BC2E-mapping.dmp