Analysis
-
max time kernel
144s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 15:08
Static task
static1
Behavioral task
behavioral1
Sample
733547b3964e5000616fa0fa71f31e8e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
733547b3964e5000616fa0fa71f31e8e.exe
Resource
win10v20201028
General
-
Target
733547b3964e5000616fa0fa71f31e8e.exe
-
Size
12.6MB
-
MD5
733547b3964e5000616fa0fa71f31e8e
-
SHA1
3e4691a61f811d8cc8c10b7a6e64c41d1f645c86
-
SHA256
60bcd69140ed6a79b7baa6a0005bfbef07a13f6918db29f4e6b1e6f5290d6db3
-
SHA512
0df59d78a4222f4e0e693668a33e4c28af17991ee119f58892524be5494f29830f81361b7ca4f1570909530d80089a8c08a6eb73e7455c0ccd32d2e700fcda7f
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
tryutcar.exepid process 4020 tryutcar.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2128 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tryutcar.exedescription pid process target process PID 4020 set thread context of 2128 4020 tryutcar.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
733547b3964e5000616fa0fa71f31e8e.exetryutcar.exedescription pid process target process PID 4056 wrote to memory of 1844 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 1844 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 1844 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 2064 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 2064 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 2064 4056 733547b3964e5000616fa0fa71f31e8e.exe cmd.exe PID 4056 wrote to memory of 3488 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 3488 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 3488 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1892 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1892 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1892 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1352 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1352 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4056 wrote to memory of 1352 4056 733547b3964e5000616fa0fa71f31e8e.exe sc.exe PID 4020 wrote to memory of 2128 4020 tryutcar.exe svchost.exe PID 4020 wrote to memory of 2128 4020 tryutcar.exe svchost.exe PID 4020 wrote to memory of 2128 4020 tryutcar.exe svchost.exe PID 4020 wrote to memory of 2128 4020 tryutcar.exe svchost.exe PID 4020 wrote to memory of 2128 4020 tryutcar.exe svchost.exe PID 4056 wrote to memory of 1184 4056 733547b3964e5000616fa0fa71f31e8e.exe netsh.exe PID 4056 wrote to memory of 1184 4056 733547b3964e5000616fa0fa71f31e8e.exe netsh.exe PID 4056 wrote to memory of 1184 4056 733547b3964e5000616fa0fa71f31e8e.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\733547b3964e5000616fa0fa71f31e8e.exe"C:\Users\Admin\AppData\Local\Temp\733547b3964e5000616fa0fa71f31e8e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vfbthpkl\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tryutcar.exe" C:\Windows\SysWOW64\vfbthpkl\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create vfbthpkl binPath= "C:\Windows\SysWOW64\vfbthpkl\tryutcar.exe /d\"C:\Users\Admin\AppData\Local\Temp\733547b3964e5000616fa0fa71f31e8e.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description vfbthpkl "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start vfbthpkl2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\vfbthpkl\tryutcar.exeC:\Windows\SysWOW64\vfbthpkl\tryutcar.exe /d"C:\Users\Admin\AppData\Local\Temp\733547b3964e5000616fa0fa71f31e8e.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tryutcar.exeMD5
7d542b4a7dbf3dfbe9bb7471ef25a080
SHA11cadfee09ec88d96fe2a9e9c6dc74e616bfb1666
SHA2567372ff9d6d9498d16092a97b01000c38d4de6c99aa89bab7f8cacc9600716e18
SHA51228ca54735939cdcd93c1a9f1b1cbc63849b532e00fbc4612949bbf9be70b331bf3ecd8d4ec294d20615e06dc05fb3a596113f33f24bc03fe8e622ac9a997fd24
-
C:\Windows\SysWOW64\vfbthpkl\tryutcar.exeMD5
7d542b4a7dbf3dfbe9bb7471ef25a080
SHA11cadfee09ec88d96fe2a9e9c6dc74e616bfb1666
SHA2567372ff9d6d9498d16092a97b01000c38d4de6c99aa89bab7f8cacc9600716e18
SHA51228ca54735939cdcd93c1a9f1b1cbc63849b532e00fbc4612949bbf9be70b331bf3ecd8d4ec294d20615e06dc05fb3a596113f33f24bc03fe8e622ac9a997fd24
-
memory/1184-12-0x0000000000000000-mapping.dmp
-
memory/1352-7-0x0000000000000000-mapping.dmp
-
memory/1844-2-0x0000000000000000-mapping.dmp
-
memory/1892-6-0x0000000000000000-mapping.dmp
-
memory/2064-3-0x0000000000000000-mapping.dmp
-
memory/2128-9-0x0000000003080000-0x0000000003095000-memory.dmpFilesize
84KB
-
memory/2128-10-0x0000000003089A6B-mapping.dmp
-
memory/3488-5-0x0000000000000000-mapping.dmp