Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 14:25
Static task
static1
Behavioral task
behavioral1
Sample
433b76b50aff2852f8e7a5071594df71.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
433b76b50aff2852f8e7a5071594df71.exe
Resource
win10v20201028
General
-
Target
433b76b50aff2852f8e7a5071594df71.exe
-
Size
14.7MB
-
MD5
433b76b50aff2852f8e7a5071594df71
-
SHA1
d721a6ffb0c601d9b7209ce0cf0334d9a70b4810
-
SHA256
289638ff4cfd284afe4780faa40c63f0c484de2eaabe35f006cbfa7f538fe891
-
SHA512
4b99fa41f4e937f109e9b3564146c12ed63bda8e354c2078a0c5d56af9afb611673a586995fb942efe3514c9c278c972c3610488e12410816e894127fcf08f7a
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
clfkcbws.exepid process 1680 clfkcbws.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 964 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
clfkcbws.exedescription pid process target process PID 1680 set thread context of 964 1680 clfkcbws.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
433b76b50aff2852f8e7a5071594df71.execlfkcbws.exedescription pid process target process PID 1696 wrote to memory of 1708 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1708 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1708 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1708 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1108 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1108 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1108 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1108 1696 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 1696 wrote to memory of 1356 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1356 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1356 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1356 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1296 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1296 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1296 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1296 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 268 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 268 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 268 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 268 1696 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 1696 wrote to memory of 1016 1696 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 1696 wrote to memory of 1016 1696 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 1696 wrote to memory of 1016 1696 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 1696 wrote to memory of 1016 1696 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe PID 1680 wrote to memory of 964 1680 clfkcbws.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rfbgoqrm\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\clfkcbws.exe" C:\Windows\SysWOW64\rfbgoqrm\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create rfbgoqrm binPath= "C:\Windows\SysWOW64\rfbgoqrm\clfkcbws.exe /d\"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description rfbgoqrm "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start rfbgoqrm2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\rfbgoqrm\clfkcbws.exeC:\Windows\SysWOW64\rfbgoqrm\clfkcbws.exe /d"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\clfkcbws.exeMD5
1ee4bd25aa7ded44aa9ca57bc69d0c50
SHA1ce93ea9461fecf270448ca8ed09b16dbd8cd4842
SHA2568ceaabcc4c809286e3a4ec8d1832ec8876764f31a9362c943548a750e225dacd
SHA5129c152f916585730fea89d3c529ad8910a99cf6c4d22b0db1b4de11d75482cf2cd18f1334c1337bd901bb786a4cc7f9e0c9565c67d2cc257d27045699e22bad15
-
C:\Windows\SysWOW64\rfbgoqrm\clfkcbws.exeMD5
1ee4bd25aa7ded44aa9ca57bc69d0c50
SHA1ce93ea9461fecf270448ca8ed09b16dbd8cd4842
SHA2568ceaabcc4c809286e3a4ec8d1832ec8876764f31a9362c943548a750e225dacd
SHA5129c152f916585730fea89d3c529ad8910a99cf6c4d22b0db1b4de11d75482cf2cd18f1334c1337bd901bb786a4cc7f9e0c9565c67d2cc257d27045699e22bad15
-
memory/268-9-0x0000000000000000-mapping.dmp
-
memory/964-16-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/964-14-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/964-15-0x00000000000C9A6B-mapping.dmp
-
memory/1016-11-0x0000000000000000-mapping.dmp
-
memory/1108-5-0x0000000000000000-mapping.dmp
-
memory/1296-8-0x0000000000000000-mapping.dmp
-
memory/1356-7-0x0000000000000000-mapping.dmp
-
memory/1680-12-0x0000000000E19000-0x0000000000E1A000-memory.dmpFilesize
4KB
-
memory/1680-13-0x0000000001170000-0x0000000001181000-memory.dmpFilesize
68KB
-
memory/1696-2-0x00000000002D7000-0x00000000002D8000-memory.dmpFilesize
4KB
-
memory/1696-3-0x00000000025A0000-0x00000000025B1000-memory.dmpFilesize
68KB
-
memory/1708-4-0x0000000000000000-mapping.dmp