Analysis
-
max time kernel
146s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 14:15
Static task
static1
Behavioral task
behavioral1
Sample
354b570754a39b62f08fa243e04e0ac4.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
354b570754a39b62f08fa243e04e0ac4.exe
Resource
win10v20201028
General
-
Target
354b570754a39b62f08fa243e04e0ac4.exe
-
Size
11.8MB
-
MD5
354b570754a39b62f08fa243e04e0ac4
-
SHA1
9662324cd2f8a2f1600ba42b64cf14b30d05b57f
-
SHA256
65b06139254e9d7ad3e56e67b498473d31abb7e8b9a32a1a537fd9ec607232ff
-
SHA512
b5e315aaec0e8b6d4968110cbb73d344a371410e6d7b879145156895823eeed9fda7430c39a2b9f87451fb70fc44d41bfd6e651d11d53cbe70637134f0dd24b6
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
fvbuvdtc.exepid process 964 fvbuvdtc.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1060 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fvbuvdtc.exedescription pid process target process PID 964 set thread context of 1060 964 fvbuvdtc.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
354b570754a39b62f08fa243e04e0ac4.exefvbuvdtc.exedescription pid process target process PID 1828 wrote to memory of 1984 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1984 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1984 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1984 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1416 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1416 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1416 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 1416 1828 354b570754a39b62f08fa243e04e0ac4.exe cmd.exe PID 1828 wrote to memory of 616 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 616 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 616 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 616 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1728 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1728 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1728 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1728 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1032 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1032 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1032 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1032 1828 354b570754a39b62f08fa243e04e0ac4.exe sc.exe PID 1828 wrote to memory of 1896 1828 354b570754a39b62f08fa243e04e0ac4.exe netsh.exe PID 1828 wrote to memory of 1896 1828 354b570754a39b62f08fa243e04e0ac4.exe netsh.exe PID 1828 wrote to memory of 1896 1828 354b570754a39b62f08fa243e04e0ac4.exe netsh.exe PID 1828 wrote to memory of 1896 1828 354b570754a39b62f08fa243e04e0ac4.exe netsh.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe PID 964 wrote to memory of 1060 964 fvbuvdtc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\354b570754a39b62f08fa243e04e0ac4.exe"C:\Users\Admin\AppData\Local\Temp\354b570754a39b62f08fa243e04e0ac4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lbmnfxfj\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fvbuvdtc.exe" C:\Windows\SysWOW64\lbmnfxfj\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create lbmnfxfj binPath= "C:\Windows\SysWOW64\lbmnfxfj\fvbuvdtc.exe /d\"C:\Users\Admin\AppData\Local\Temp\354b570754a39b62f08fa243e04e0ac4.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description lbmnfxfj "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lbmnfxfj2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\lbmnfxfj\fvbuvdtc.exeC:\Windows\SysWOW64\lbmnfxfj\fvbuvdtc.exe /d"C:\Users\Admin\AppData\Local\Temp\354b570754a39b62f08fa243e04e0ac4.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fvbuvdtc.exeMD5
77d8358d1ee1b69d1ef3bf0ce33bab0e
SHA1f8b43049e4bed39b28c12811aca759ea39d77d08
SHA2564da07eef0d5ec4e818795fa22e40db17f3eaa953b8d3f25ec28e85249536626c
SHA512cae8067d0c0f45b7f174535962700333f1331365d89ee569ca048786a940c0e159f43aecf466d966c37fd526f1d813e2f6d4fedbc9bab4413a0c027eee51de53
-
C:\Windows\SysWOW64\lbmnfxfj\fvbuvdtc.exeMD5
77d8358d1ee1b69d1ef3bf0ce33bab0e
SHA1f8b43049e4bed39b28c12811aca759ea39d77d08
SHA2564da07eef0d5ec4e818795fa22e40db17f3eaa953b8d3f25ec28e85249536626c
SHA512cae8067d0c0f45b7f174535962700333f1331365d89ee569ca048786a940c0e159f43aecf466d966c37fd526f1d813e2f6d4fedbc9bab4413a0c027eee51de53
-
memory/616-5-0x0000000000000000-mapping.dmp
-
memory/1032-7-0x0000000000000000-mapping.dmp
-
memory/1060-11-0x0000000000089A6B-mapping.dmp
-
memory/1060-10-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1416-3-0x0000000000000000-mapping.dmp
-
memory/1728-6-0x0000000000000000-mapping.dmp
-
memory/1896-8-0x0000000000000000-mapping.dmp
-
memory/1984-2-0x0000000000000000-mapping.dmp