Analysis
-
max time kernel
148s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 15:53
Static task
static1
Behavioral task
behavioral1
Sample
b23ec80dcfd2ee8ad973ac39a4b6488b.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
b23ec80dcfd2ee8ad973ac39a4b6488b.exe
Resource
win10v20201028
General
-
Target
b23ec80dcfd2ee8ad973ac39a4b6488b.exe
-
Size
13.5MB
-
MD5
b23ec80dcfd2ee8ad973ac39a4b6488b
-
SHA1
58a7c7a55442f3f22b61bb94eff369288f8b6392
-
SHA256
388e770957cb4e6e396d8ef4a0cf158a69e3cdeb98157b013e79327013706afe
-
SHA512
4f92d9235235702099771a60f5c8ea1fe83dd8dc2dbd05649d353f43de4c54a89249fb513659aad3022688e98cc8dbbe5a3ba144e12eedc3c2c000ca5d8e355d
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
vdswjhqq.exepid process 564 vdswjhqq.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1036 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vdswjhqq.exedescription pid process target process PID 564 set thread context of 1036 564 vdswjhqq.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
b23ec80dcfd2ee8ad973ac39a4b6488b.exevdswjhqq.exedescription pid process target process PID 2024 wrote to memory of 1684 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1684 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1684 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1684 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1752 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1752 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1752 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1752 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe cmd.exe PID 2024 wrote to memory of 1840 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 1840 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 1840 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 1840 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 768 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 768 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 768 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 768 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 240 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 240 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 240 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 240 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe sc.exe PID 2024 wrote to memory of 1068 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe netsh.exe PID 2024 wrote to memory of 1068 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe netsh.exe PID 2024 wrote to memory of 1068 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe netsh.exe PID 2024 wrote to memory of 1068 2024 b23ec80dcfd2ee8ad973ac39a4b6488b.exe netsh.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe PID 564 wrote to memory of 1036 564 vdswjhqq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b23ec80dcfd2ee8ad973ac39a4b6488b.exe"C:\Users\Admin\AppData\Local\Temp\b23ec80dcfd2ee8ad973ac39a4b6488b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jtfvybzd\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vdswjhqq.exe" C:\Windows\SysWOW64\jtfvybzd\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create jtfvybzd binPath= "C:\Windows\SysWOW64\jtfvybzd\vdswjhqq.exe /d\"C:\Users\Admin\AppData\Local\Temp\b23ec80dcfd2ee8ad973ac39a4b6488b.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description jtfvybzd "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start jtfvybzd2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\jtfvybzd\vdswjhqq.exeC:\Windows\SysWOW64\jtfvybzd\vdswjhqq.exe /d"C:\Users\Admin\AppData\Local\Temp\b23ec80dcfd2ee8ad973ac39a4b6488b.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vdswjhqq.exeMD5
c18e564be45ada391e490814b5e60033
SHA18c10713675894e4499bbc38eac90f320623cccf1
SHA2563c71a8c7c1eb564391473b2e8e64ff02977a1255a481cd5612ab5ab7b3abe3ca
SHA512e822007fc8f9752413de4c0037a520324d71ddf416342a27e3b1c87ddce675676d29d5fb68e9cb21229b2cf0dcb0ebf806aa247906b2a19a89631ce94151da2a
-
C:\Windows\SysWOW64\jtfvybzd\vdswjhqq.exeMD5
c18e564be45ada391e490814b5e60033
SHA18c10713675894e4499bbc38eac90f320623cccf1
SHA2563c71a8c7c1eb564391473b2e8e64ff02977a1255a481cd5612ab5ab7b3abe3ca
SHA512e822007fc8f9752413de4c0037a520324d71ddf416342a27e3b1c87ddce675676d29d5fb68e9cb21229b2cf0dcb0ebf806aa247906b2a19a89631ce94151da2a
-
memory/240-12-0x0000000000000000-mapping.dmp
-
memory/564-17-0x0000000004700000-0x0000000004711000-memory.dmpFilesize
68KB
-
memory/564-16-0x00000000042AC000-0x00000000042AD000-memory.dmpFilesize
4KB
-
memory/768-10-0x0000000000000000-mapping.dmp
-
memory/1036-19-0x0000000000089A6B-mapping.dmp
-
memory/1036-18-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1068-15-0x0000000000000000-mapping.dmp
-
memory/1684-4-0x0000000000000000-mapping.dmp
-
memory/1752-5-0x0000000000000000-mapping.dmp
-
memory/1840-8-0x0000000000000000-mapping.dmp
-
memory/2024-2-0x000000000421C000-0x000000000421D000-memory.dmpFilesize
4KB
-
memory/2024-3-0x0000000005BB0000-0x0000000005BC1000-memory.dmpFilesize
68KB