cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582

General

Target
cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe
Size 10.1MB
Sample201109-bdl4d83rae
SHA256 cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582
MD5 6b4e1dadf79b7ba387414ac7c89911da
SHA1 545803fc56f0107c4b09f01712a745c4bc3bffc2
SHA512 3c5d70ec0ff67a36fdb752c6ecea7233cca3d3f5ffceca9078134442e223efc9ec94bc232ff00557ef3affed95d1876a1400e0d353dd0c7eedbd9a1a8fa57c65
MD5 SHA1 SHA512

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
1136	xhpcwgbp.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 4088	1136	xhpcwgbp.exe	91

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3984	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	76
PID 412 wrote to memory of 3984	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	76
PID 412 wrote to memory of 3984	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	76
PID 412 wrote to memory of 2248	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	78
PID 412 wrote to memory of 2248	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	78
PID 412 wrote to memory of 2248	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	78
PID 412 wrote to memory of 868	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	80
PID 412 wrote to memory of 868	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	80
PID 412 wrote to memory of 868	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	80
PID 412 wrote to memory of 3712	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	82
PID 412 wrote to memory of 3712	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	82
PID 412 wrote to memory of 3712	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	82
PID 412 wrote to memory of 704	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	84
PID 412 wrote to memory of 704	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	84
PID 412 wrote to memory of 704	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	84
PID 412 wrote to memory of 3456	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	86
PID 412 wrote to memory of 3456	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	86
PID 412 wrote to memory of 3456	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	86
PID 412 wrote to memory of 3716	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	89
PID 412 wrote to memory of 3716	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	89
PID 412 wrote to memory of 3716	412	cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe	89
PID 1136 wrote to memory of 4088	1136	xhpcwgbp.exe	91
PID 1136 wrote to memory of 4088	1136	xhpcwgbp.exe	91
PID 1136 wrote to memory of 4088	1136	xhpcwgbp.exe	91
PID 1136 wrote to memory of 4088	1136	xhpcwgbp.exe	91
PID 1136 wrote to memory of 4088	1136	xhpcwgbp.exe	91

C:\Users\Admin\AppData\Local\Temp\cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe
"C:\Users\Admin\AppData\Local\Temp\cdbda4f45e8cb4d6117bcd21304c66a78bcb73f840f48d8e523e76e5b0b57582.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wkyuxnd\
  2⤵
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xhpcwgbp.exe" C:\Windows\SysWOW64\wkyuxnd\
  2⤵
  PID:2248
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wkyuxnd binPath= "C:\Windows\SysWOW64\wkyuxnd\xhpcwgbp.exe" type= own start= auto DisplayName= "P2P Support"
  2⤵
  PID:868
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wkyuxnd "Internet Mobile Support"
  2⤵
  PID:3712
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wkyuxnd
  2⤵
  PID:704
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7740.bat" "
  2⤵
  PID:3716

C:\Windows\SysWOW64\wkyuxnd\xhpcwgbp.exe
C:\Windows\SysWOW64\wkyuxnd\xhpcwgbp.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4088