661d12b5e6cb61f54086d48b865ef5989ec00379f52b92fdb68b2ef59eddef43

Analysis

max time kernel
1801s
max time network
391s
platform
windows10_x64
resource
win10v20201028
submitted
01-12-2020 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads3/finfisher.1.bin.exe
Size

771KB
MD5

074919f13d07cd6ce92bb0738971afc7
SHA1

9f9a18e81e9b39bd2f047004b8e3b4cb0fb505c9
SHA256

f827c92fbe832db3f09f47fe0dcaafd89b40c7064ab90833a1f418f2d1e75e8e
SHA512

cdd87c636df500053ec1b410bc467e09186df953c1e1bcb1dc9a8d4bba82df486f59f0bd9942051f84301b05201952cb137b8364bf93d0c066822eb065b9b749

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

finfisher.1.bin.exefinfisher.1.bin.exefinfisher.1.bin.exe_svchost.exe

pid process

2348 finfisher.1.bin.exe
1364 finfisher.1.bin.exe
3432 finfisher.1.bin.exe_
2236 svchost.exe
Deletes itself 1 IoCs

Processes:

finfisher.1.bin.exe

pid process

2348 finfisher.1.bin.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

finfisher.1.bin.exe

description pid process target process

PID 3276 set thread context of 2348 3276 finfisher.1.bin.exe finfisher.1.bin.exe

pid	process
2348	finfisher.1.bin.exe
1364	finfisher.1.bin.exe
3432	finfisher.1.bin.exe_
2236	svchost.exe

pid	process
2348	finfisher.1.bin.exe

description	pid	process	target process
PID 3276 set thread context of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe

Drops file in Windows directory 18 IoCs

Processes:

finfisher.1.bin.exe_

description	ioc	process
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\80C.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\12C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\11.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\11.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\11C.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\02.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\02C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\02.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\7F.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\80C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\12.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\11C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\7FC.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\7FC.dat	finfisher.1.bin.exe_
File opened for modification	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\12.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\12C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\02C.dat	finfisher.1.bin.exe_
File created	C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\7F.dat	finfisher.1.bin.exe_

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1304 540 WerFault.exe winlogon.exe

pid	pid_target	process	target process
1304	540	WerFault.exe	winlogon.exe

Suspicious behavior: EnumeratesProcesses 6725 IoCs

Processes:

finfisher.1.bin.exe_svchost.exeWerFault.exe

pid	process
3432	finfisher.1.bin.exe_
3432	finfisher.1.bin.exe_
2236	svchost.exe
2236	svchost.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe
2236	svchost.exe

Suspicious behavior: LoadsDriver 468814 IoCs

Processes:

pid	process
2648
2712
3960
1648
1808
2032
1656
3096
3728
3572
732
3892
2760
3964
2120
1172
2188
1332
3176
3312
3604
3592
3876
1484
1392
3764
1508
1444
2312
596
2072
544
2068
3932
2876
1568
3192
2452
980
352
1064
1132
696
3808
976
772
780
716
2776
2432
3024
2836
2792
2392
1208
2192
2744
2664
2260
2592
196
3980
212
1124

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

finfisher.1.bin.exe

pid process

2348 finfisher.1.bin.exe

pid	process
2348	finfisher.1.bin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

finfisher.1.bin.exe_WerFault.exe

description	pid	process
Token: SeBackupPrivilege	3432	finfisher.1.bin.exe_
Token: SeSecurityPrivilege	3432	finfisher.1.bin.exe_
Token: SeDebugPrivilege	1304	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

finfisher.1.bin.exefinfisher.1.bin.exefinfisher.1.bin.exesvchost.exe

description	pid	process	target process
PID 3276 wrote to memory of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 3276 wrote to memory of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 3276 wrote to memory of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 3276 wrote to memory of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 3276 wrote to memory of 2348	3276	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 2348 wrote to memory of 1364	2348	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 2348 wrote to memory of 1364	2348	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 2348 wrote to memory of 1364	2348	finfisher.1.bin.exe	finfisher.1.bin.exe
PID 1364 wrote to memory of 3432	1364	finfisher.1.bin.exe	finfisher.1.bin.exe_
PID 1364 wrote to memory of 3432	1364	finfisher.1.bin.exe	finfisher.1.bin.exe_
PID 2348 wrote to memory of 3724	2348	finfisher.1.bin.exe	explorer.exe
PID 2348 wrote to memory of 3724	2348	finfisher.1.bin.exe	explorer.exe
PID 2348 wrote to memory of 3724	2348	finfisher.1.bin.exe	explorer.exe
PID 2236 wrote to memory of 540	2236	svchost.exe	winlogon.exe
PID 2236 wrote to memory of 540	2236	svchost.exe	winlogon.exe
PID 2236 wrote to memory of 540	2236	svchost.exe	winlogon.exe
PID 2236 wrote to memory of 3028	2236	svchost.exe	Explorer.EXE
PID 2236 wrote to memory of 3028	2236	svchost.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:540

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 540 -s 1264
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3028

C:\Users\Admin\AppData\Local\Temp\Downloads3\finfisher.1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads3\finfisher.1.bin.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3276

C:\Users\Admin\AppData\Local\Temp\TMPB6D001F0\finfisher.1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\\TMPB6D001F0\finfisher.1.bin.exe"
3⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2348

C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe_
C:\Users\Admin\AppData\Local\Temp\\finfisher.1.bin.exe_
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:3724

C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\svchost.exe
C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2364

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2884

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:3916

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:504

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:200

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TMPB6D001F0\finfisher.1.bin.exe
MD5
074919f13d07cd6ce92bb0738971afc7

SHA1
9f9a18e81e9b39bd2f047004b8e3b4cb0fb505c9

SHA256
f827c92fbe832db3f09f47fe0dcaafd89b40c7064ab90833a1f418f2d1e75e8e

SHA512
cdd87c636df500053ec1b410bc467e09186df953c1e1bcb1dc9a8d4bba82df486f59f0bd9942051f84301b05201952cb137b8364bf93d0c066822eb065b9b749

Download Submit
C:\Users\Admin\AppData\Local\Temp\TMPB6D001F0\finfisher.1.bin.exe
MD5
074919f13d07cd6ce92bb0738971afc7

SHA1
9f9a18e81e9b39bd2f047004b8e3b4cb0fb505c9

SHA256
f827c92fbe832db3f09f47fe0dcaafd89b40c7064ab90833a1f418f2d1e75e8e

SHA512
cdd87c636df500053ec1b410bc467e09186df953c1e1bcb1dc9a8d4bba82df486f59f0bd9942051f84301b05201952cb137b8364bf93d0c066822eb065b9b749

Download Submit
C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe
MD5
837c8e15a154956194219ddf6e26cd09

SHA1
1f46a8f7799a48512eb1497ffcae35cbb20a67d5

SHA256
f18afbad0230af8c7ec7b4c1d25544f3d3445a825861a1de18432de5b4586c7b

SHA512
52ea06a084c5f0a87024a9e34cd9aac4ba42285b90e555e6c6eaea7e09cfe259165f7f2019160ee7f4a4e4d02b31acab307ab1bc34dd43b549532041b0299064

Download Submit
C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe
MD5
837c8e15a154956194219ddf6e26cd09

SHA1
1f46a8f7799a48512eb1497ffcae35cbb20a67d5

SHA256
f18afbad0230af8c7ec7b4c1d25544f3d3445a825861a1de18432de5b4586c7b

SHA512
52ea06a084c5f0a87024a9e34cd9aac4ba42285b90e555e6c6eaea7e09cfe259165f7f2019160ee7f4a4e4d02b31acab307ab1bc34dd43b549532041b0299064

Download Submit
C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe_
MD5
4f08b7808f785005179bd799d7f02a12

SHA1
130212336fe769ef2c82f19fd17f61b69f7d6ecd

SHA256
fa5ddd5f044ab5a3817a2a31f3d798d411153da73bbf0d205736283944513e56

SHA512
bbf7356450780268beb3a26a4bc03ba78b71ffd00723b6b4c68240e481015e975d5371d20c32075cf0ab4b8bf5862b07edbea8eb0b88b850d8b9bdbfd1a55638

Download Submit
C:\Users\Admin\AppData\Local\Temp\finfisher.1.bin.exe_
MD5
4f08b7808f785005179bd799d7f02a12

SHA1
130212336fe769ef2c82f19fd17f61b69f7d6ecd

SHA256
fa5ddd5f044ab5a3817a2a31f3d798d411153da73bbf0d205736283944513e56

SHA512
bbf7356450780268beb3a26a4bc03ba78b71ffd00723b6b4c68240e481015e975d5371d20c32075cf0ab4b8bf5862b07edbea8eb0b88b850d8b9bdbfd1a55638

Download Submit
C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\svchost.exe
MD5
820b2fa51f6f50a94a295bfc8ac381ec

SHA1
b23a3b57c8edb6637cc1fc68996929c0151044dd

SHA256
1ef2012a955f246880d49731a831ed524d8f73f8ff05da5389ae8056f7805136

SHA512
6d84bffb163fbe1470bd736390485f2e2dee44be2240ede789f5d9d54fc63ea9ed84272fab1c65397a38a9700749b74cd4c3fc9dc25517a9a9343fc6ca7c99b7

Download Submit
C:\Windows\Installer\{88DC4147-C6DD-47E6-9097-E0C9BA967FA0}\svchost.exe
MD5
820b2fa51f6f50a94a295bfc8ac381ec

SHA1
b23a3b57c8edb6637cc1fc68996929c0151044dd

SHA256
1ef2012a955f246880d49731a831ed524d8f73f8ff05da5389ae8056f7805136

SHA512
6d84bffb163fbe1470bd736390485f2e2dee44be2240ede789f5d9d54fc63ea9ed84272fab1c65397a38a9700749b74cd4c3fc9dc25517a9a9343fc6ca7c99b7

Download Submit
memory/1304-14-0x000001BFA6010000-0x000001BFA6011000-memory.dmp

Filesize
4KB

Download
memory/1304-17-0x000001BFA6E80000-0x000001BFA6E81000-memory.dmp

Filesize
4KB

Download
memory/1304-15-0x000001BFA6010000-0x000001BFA6011000-memory.dmp

Filesize
4KB

Download
memory/1364-5-0x0000000000000000-mapping.dmp

Download
memory/2348-2-0x0000000000401E1F-mapping.dmp

Download
memory/3432-8-0x0000000000000000-mapping.dmp

Download
memory/3724-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads