Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 15:20
Static task
static1
Behavioral task
behavioral1
Sample
8129457fa7210937a1467a21f241b201.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
8129457fa7210937a1467a21f241b201.exe
Resource
win10v20201028
General
-
Target
8129457fa7210937a1467a21f241b201.exe
-
Size
14.3MB
-
MD5
8129457fa7210937a1467a21f241b201
-
SHA1
f5013dad172969224076ca791692ac60d2f5f027
-
SHA256
acd329362b311a912e88b825259f552d41d15ec07a7c640fb14f3327a514b323
-
SHA512
9ae2f59095e0afe5839d8356461cb4d385edfc02161b54c4cb39f2649afb24924265bd4a43c853f062243a9fe55e5b2947cb8b78bf7ca26321c91205fd35b86e
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
frsmhdeb.exepid process 656 frsmhdeb.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1956 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
frsmhdeb.exedescription pid process target process PID 656 set thread context of 1956 656 frsmhdeb.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
8129457fa7210937a1467a21f241b201.exefrsmhdeb.exedescription pid process target process PID 1672 wrote to memory of 1424 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1424 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1424 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1424 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1708 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1708 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1708 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1708 1672 8129457fa7210937a1467a21f241b201.exe cmd.exe PID 1672 wrote to memory of 1692 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1692 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1692 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1692 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1648 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1648 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1648 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1648 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1096 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1096 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1096 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 1672 wrote to memory of 1096 1672 8129457fa7210937a1467a21f241b201.exe sc.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 656 wrote to memory of 1956 656 frsmhdeb.exe svchost.exe PID 1672 wrote to memory of 552 1672 8129457fa7210937a1467a21f241b201.exe netsh.exe PID 1672 wrote to memory of 552 1672 8129457fa7210937a1467a21f241b201.exe netsh.exe PID 1672 wrote to memory of 552 1672 8129457fa7210937a1467a21f241b201.exe netsh.exe PID 1672 wrote to memory of 552 1672 8129457fa7210937a1467a21f241b201.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8129457fa7210937a1467a21f241b201.exe"C:\Users\Admin\AppData\Local\Temp\8129457fa7210937a1467a21f241b201.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hpdvkypg\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\frsmhdeb.exe" C:\Windows\SysWOW64\hpdvkypg\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hpdvkypg binPath= "C:\Windows\SysWOW64\hpdvkypg\frsmhdeb.exe /d\"C:\Users\Admin\AppData\Local\Temp\8129457fa7210937a1467a21f241b201.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hpdvkypg "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hpdvkypg2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\hpdvkypg\frsmhdeb.exeC:\Windows\SysWOW64\hpdvkypg\frsmhdeb.exe /d"C:\Users\Admin\AppData\Local\Temp\8129457fa7210937a1467a21f241b201.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\frsmhdeb.exeMD5
027ddc4a490ff9a3b1b6c07f64590ebe
SHA18c3797da4be77953a24393a9a177ba8c49e47726
SHA2567e20d756cd61aeefbdecca80d28cccd1fa16674c9299f3eddb2e92e70258e2ed
SHA512e88b4b0855e527094f0b479a27e1c04295da099c531071843f94897a247b0188efa1a2257bb770eee0c1d5ec63a52a0f9c3ab087b0b2f2d888b360cf5ef08385
-
C:\Windows\SysWOW64\hpdvkypg\frsmhdeb.exeMD5
027ddc4a490ff9a3b1b6c07f64590ebe
SHA18c3797da4be77953a24393a9a177ba8c49e47726
SHA2567e20d756cd61aeefbdecca80d28cccd1fa16674c9299f3eddb2e92e70258e2ed
SHA512e88b4b0855e527094f0b479a27e1c04295da099c531071843f94897a247b0188efa1a2257bb770eee0c1d5ec63a52a0f9c3ab087b0b2f2d888b360cf5ef08385
-
memory/552-12-0x0000000000000000-mapping.dmp
-
memory/1096-7-0x0000000000000000-mapping.dmp
-
memory/1424-2-0x0000000000000000-mapping.dmp
-
memory/1648-6-0x0000000000000000-mapping.dmp
-
memory/1692-5-0x0000000000000000-mapping.dmp
-
memory/1708-3-0x0000000000000000-mapping.dmp
-
memory/1956-9-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1956-10-0x0000000000089A6B-mapping.dmp