6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819

General

Target
6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe
Size 14.4MB
Sample201113-edd745k5se
SHA256 6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819
MD5 cc3f9799f13e9825ba4059f8c156df69
SHA1 467a644301337bb474d49c544174a789ca7b37f3
SHA512 a0720c1c0fa3f47eda64207122d7f5a2ec3bd209a819480c253e59902425c5cad1ddff2fdff9ba762b86e0f14d559e231374b92a1dbe0e60fe1b0b93088a79e1
MD5 SHA1 SHA512

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
1132	zwdvbsht.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 4064	1132	zwdvbsht.exe	90

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2504	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	74
PID 980 wrote to memory of 2504	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	74
PID 980 wrote to memory of 2504	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	74
PID 980 wrote to memory of 3904	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	77
PID 980 wrote to memory of 3904	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	77
PID 980 wrote to memory of 3904	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	77
PID 980 wrote to memory of 640	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	79
PID 980 wrote to memory of 640	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	79
PID 980 wrote to memory of 640	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	79
PID 980 wrote to memory of 3932	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	81
PID 980 wrote to memory of 3932	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	81
PID 980 wrote to memory of 3932	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	81
PID 980 wrote to memory of 984	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	83
PID 980 wrote to memory of 984	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	83
PID 980 wrote to memory of 984	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	83
PID 980 wrote to memory of 1840	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	86
PID 980 wrote to memory of 1840	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	86
PID 980 wrote to memory of 1840	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	86
PID 980 wrote to memory of 2136	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	88
PID 980 wrote to memory of 2136	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	88
PID 980 wrote to memory of 2136	980	6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe	88
PID 1132 wrote to memory of 4064	1132	zwdvbsht.exe	90
PID 1132 wrote to memory of 4064	1132	zwdvbsht.exe	90
PID 1132 wrote to memory of 4064	1132	zwdvbsht.exe	90
PID 1132 wrote to memory of 4064	1132	zwdvbsht.exe	90
PID 1132 wrote to memory of 4064	1132	zwdvbsht.exe	90

C:\Users\Admin\AppData\Local\Temp\6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe
"C:\Users\Admin\AppData\Local\Temp\6b2eb0949d00fd9c42298b9458a56ce9dd189f72b2e30b76306d7f0f0ffc6819.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bcxwlmlp\
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zwdvbsht.exe" C:\Windows\SysWOW64\bcxwlmlp\
  2⤵
  PID:3904
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create bcxwlmlp binPath= "C:\Windows\SysWOW64\bcxwlmlp\zwdvbsht.exe" type= own start= auto DisplayName= "P2P Support"
  2⤵
  PID:640
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description bcxwlmlp "Internet Mobile Support"
  2⤵
  PID:3932
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start bcxwlmlp
  2⤵
  PID:984
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:1840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6727.bat" "
  2⤵
  PID:2136

C:\Windows\SysWOW64\bcxwlmlp\zwdvbsht.exe
C:\Windows\SysWOW64\bcxwlmlp\zwdvbsht.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4064