Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 12:46
Static task
static1
Behavioral task
behavioral1
Sample
ae671935e94e00c6ac5cd59a91401339.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ae671935e94e00c6ac5cd59a91401339.exe
Resource
win10v20201028
General
-
Target
ae671935e94e00c6ac5cd59a91401339.exe
-
Size
11.7MB
-
MD5
ae671935e94e00c6ac5cd59a91401339
-
SHA1
946abd7d7fce2ae16ddaf16349667e225762dfe4
-
SHA256
8dea29eb868a36b9a4a8d00e8aa9a8e68f720cb50ebdab0b6dbb650ba1c7935c
-
SHA512
7e0f55480e102510d6d7edb2c3400f61feefd56557debf03ff0fa7d9ffab50b76d1872f9b65f5f2a39a0020c7b70c049f812c1e253689a7379cf1ca937f5fe32
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qlphxiki.exepid process 988 qlphxiki.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 936 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qlphxiki.exedescription pid process target process PID 988 set thread context of 936 988 qlphxiki.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ae671935e94e00c6ac5cd59a91401339.exeqlphxiki.exedescription pid process target process PID 1916 wrote to memory of 1624 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 1624 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 1624 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 1624 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 108 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 108 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 108 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 108 1916 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 1916 wrote to memory of 112 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 112 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 112 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 112 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1896 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1896 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1896 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1896 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1640 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1640 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1640 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1640 1916 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 1916 wrote to memory of 1464 1916 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 1916 wrote to memory of 1464 1916 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 1916 wrote to memory of 1464 1916 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 1916 wrote to memory of 1464 1916 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe PID 988 wrote to memory of 936 988 qlphxiki.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cagztihu\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qlphxiki.exe" C:\Windows\SysWOW64\cagztihu\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cagztihu binPath= "C:\Windows\SysWOW64\cagztihu\qlphxiki.exe /d\"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cagztihu "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cagztihu2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\cagztihu\qlphxiki.exeC:\Windows\SysWOW64\cagztihu\qlphxiki.exe /d"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qlphxiki.exeMD5
6567fa186466ad8191ea93aabbf2318e
SHA1a0ddaee841f2d8b5581b2238de4e29a257a7b8a8
SHA256b765e89f83b2dcec05ae6b36e9e701ff2b825edbde8388078dee4401a9919bcc
SHA512b72b0ca54805500540632c108ec4fca9a5fd9684d17878291b715dc7ea8a5c5b0d509d7be6706accb3172ec84ce3b7ea3b6d239303ff9950890d01282b5c975e
-
C:\Windows\SysWOW64\cagztihu\qlphxiki.exeMD5
6567fa186466ad8191ea93aabbf2318e
SHA1a0ddaee841f2d8b5581b2238de4e29a257a7b8a8
SHA256b765e89f83b2dcec05ae6b36e9e701ff2b825edbde8388078dee4401a9919bcc
SHA512b72b0ca54805500540632c108ec4fca9a5fd9684d17878291b715dc7ea8a5c5b0d509d7be6706accb3172ec84ce3b7ea3b6d239303ff9950890d01282b5c975e
-
memory/108-6-0x0000000000000000-mapping.dmp
-
memory/112-8-0x0000000000000000-mapping.dmp
-
memory/936-15-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/936-16-0x00000000000C9A6B-mapping.dmp
-
memory/988-14-0x0000000004B20000-0x0000000004B31000-memory.dmpFilesize
68KB
-
memory/988-13-0x00000000048AB000-0x00000000048AC000-memory.dmpFilesize
4KB
-
memory/1464-12-0x0000000000000000-mapping.dmp
-
memory/1624-4-0x0000000000000000-mapping.dmp
-
memory/1640-10-0x0000000000000000-mapping.dmp
-
memory/1896-9-0x0000000000000000-mapping.dmp
-
memory/1916-2-0x00000000047EB000-0x00000000047EC000-memory.dmpFilesize
4KB
-
memory/1916-3-0x0000000006060000-0x0000000006071000-memory.dmpFilesize
68KB