Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 12:46
Static task
static1
Behavioral task
behavioral1
Sample
ae671935e94e00c6ac5cd59a91401339.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ae671935e94e00c6ac5cd59a91401339.exe
Resource
win10v20201028
General
-
Target
ae671935e94e00c6ac5cd59a91401339.exe
-
Size
11.7MB
-
MD5
ae671935e94e00c6ac5cd59a91401339
-
SHA1
946abd7d7fce2ae16ddaf16349667e225762dfe4
-
SHA256
8dea29eb868a36b9a4a8d00e8aa9a8e68f720cb50ebdab0b6dbb650ba1c7935c
-
SHA512
7e0f55480e102510d6d7edb2c3400f61feefd56557debf03ff0fa7d9ffab50b76d1872f9b65f5f2a39a0020c7b70c049f812c1e253689a7379cf1ca937f5fe32
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
orxrgrci.exepid process 3152 orxrgrci.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2076 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
orxrgrci.exedescription pid process target process PID 3152 set thread context of 2076 3152 orxrgrci.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ae671935e94e00c6ac5cd59a91401339.exeorxrgrci.exedescription pid process target process PID 4052 wrote to memory of 3980 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 3980 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 3980 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 3884 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 3884 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 3884 4052 ae671935e94e00c6ac5cd59a91401339.exe cmd.exe PID 4052 wrote to memory of 208 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 208 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 208 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 3844 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 3844 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 3844 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 2120 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 2120 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 2120 4052 ae671935e94e00c6ac5cd59a91401339.exe sc.exe PID 4052 wrote to memory of 3876 4052 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 4052 wrote to memory of 3876 4052 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 4052 wrote to memory of 3876 4052 ae671935e94e00c6ac5cd59a91401339.exe netsh.exe PID 3152 wrote to memory of 2076 3152 orxrgrci.exe svchost.exe PID 3152 wrote to memory of 2076 3152 orxrgrci.exe svchost.exe PID 3152 wrote to memory of 2076 3152 orxrgrci.exe svchost.exe PID 3152 wrote to memory of 2076 3152 orxrgrci.exe svchost.exe PID 3152 wrote to memory of 2076 3152 orxrgrci.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ohkxcdwe\2⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\orxrgrci.exe" C:\Windows\SysWOW64\ohkxcdwe\2⤵PID:3884
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ohkxcdwe binPath= "C:\Windows\SysWOW64\ohkxcdwe\orxrgrci.exe /d\"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:208
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ohkxcdwe "wifi internet conection"2⤵PID:3844
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ohkxcdwe2⤵PID:2120
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:3876
-
C:\Windows\SysWOW64\ohkxcdwe\orxrgrci.exeC:\Windows\SysWOW64\ohkxcdwe\orxrgrci.exe /d"C:\Users\Admin\AppData\Local\Temp\ae671935e94e00c6ac5cd59a91401339.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
PID:2076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\orxrgrci.exeMD5
0e7bc915182d2c168803acfaffb7fe9c
SHA18a761cc25f05a8b61d8f509b5c34871466420e48
SHA2569b70b8bd04c8ab2d25ebf024b23cbf44f541c6a835d0b0b4cd35e71c284baa14
SHA5123b57cb0a86183bf91096844a3bbea5d4a1d1c8875c75776cb6f0b2ebfbd8579cfa7570d28c91d5a4bb24314607ab1f6e2c3a461aa0aaedc5190df28745d115c1
-
C:\Windows\SysWOW64\ohkxcdwe\orxrgrci.exeMD5
0e7bc915182d2c168803acfaffb7fe9c
SHA18a761cc25f05a8b61d8f509b5c34871466420e48
SHA2569b70b8bd04c8ab2d25ebf024b23cbf44f541c6a835d0b0b4cd35e71c284baa14
SHA5123b57cb0a86183bf91096844a3bbea5d4a1d1c8875c75776cb6f0b2ebfbd8579cfa7570d28c91d5a4bb24314607ab1f6e2c3a461aa0aaedc5190df28745d115c1
-
memory/208-7-0x0000000000000000-mapping.dmp
-
memory/2076-17-0x0000000000960000-0x0000000000975000-memory.dmpFilesize
84KB
-
memory/2076-16-0x0000000000969A6B-mapping.dmp
-
memory/2076-15-0x0000000000960000-0x0000000000975000-memory.dmpFilesize
84KB
-
memory/2120-9-0x0000000000000000-mapping.dmp
-
memory/3152-14-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/3152-12-0x0000000004741000-0x0000000004742000-memory.dmpFilesize
4KB
-
memory/3152-13-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/3844-8-0x0000000000000000-mapping.dmp
-
memory/3876-11-0x0000000000000000-mapping.dmp
-
memory/3884-5-0x0000000000000000-mapping.dmp
-
memory/3980-4-0x0000000000000000-mapping.dmp
-
memory/4052-2-0x0000000004896000-0x0000000004897000-memory.dmpFilesize
4KB
-
memory/4052-3-0x0000000006460000-0x0000000006461000-memory.dmpFilesize
4KB