Analysis
-
max time kernel
147s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 13:31
Static task
static1
Behavioral task
behavioral1
Sample
08b7f6b7fa0c3739b1d5a613acca95f0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
08b7f6b7fa0c3739b1d5a613acca95f0.exe
Resource
win10v20201028
General
-
Target
08b7f6b7fa0c3739b1d5a613acca95f0.exe
-
Size
13.6MB
-
MD5
08b7f6b7fa0c3739b1d5a613acca95f0
-
SHA1
a902654e7e6a6e33783f939ba4f328d693274453
-
SHA256
152e52489425d1eec835e4898ac961f508b691de0817679d630f33b5044fe8c6
-
SHA512
561ff87e01172a1af3f5519010ec0c1eaa6a2007875c3dd9023bb6448d9d1fb6a408cf0e52ec98e9efb18babb5a05b8a2571da13e9d83d5b0951f380dd751b97
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qovrqzxo.exepid process 1332 qovrqzxo.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 840 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qovrqzxo.exedescription pid process target process PID 1332 set thread context of 840 1332 qovrqzxo.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
08b7f6b7fa0c3739b1d5a613acca95f0.exeqovrqzxo.exedescription pid process target process PID 1068 wrote to memory of 1624 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1624 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1624 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1624 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1784 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1784 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1784 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 1784 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe cmd.exe PID 1068 wrote to memory of 740 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 740 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 740 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 740 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 1996 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 1996 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 1996 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 1996 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 336 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 336 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 336 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1068 wrote to memory of 336 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe sc.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1332 wrote to memory of 840 1332 qovrqzxo.exe svchost.exe PID 1068 wrote to memory of 1956 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe netsh.exe PID 1068 wrote to memory of 1956 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe netsh.exe PID 1068 wrote to memory of 1956 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe netsh.exe PID 1068 wrote to memory of 1956 1068 08b7f6b7fa0c3739b1d5a613acca95f0.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b7f6b7fa0c3739b1d5a613acca95f0.exe"C:\Users\Admin\AppData\Local\Temp\08b7f6b7fa0c3739b1d5a613acca95f0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iplsafna\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qovrqzxo.exe" C:\Windows\SysWOW64\iplsafna\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create iplsafna binPath= "C:\Windows\SysWOW64\iplsafna\qovrqzxo.exe /d\"C:\Users\Admin\AppData\Local\Temp\08b7f6b7fa0c3739b1d5a613acca95f0.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description iplsafna "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start iplsafna2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\iplsafna\qovrqzxo.exeC:\Windows\SysWOW64\iplsafna\qovrqzxo.exe /d"C:\Users\Admin\AppData\Local\Temp\08b7f6b7fa0c3739b1d5a613acca95f0.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qovrqzxo.exeMD5
8a1d21936f9f97d05c2352c990af78ee
SHA19d507c149a1b7243d79ed5b1a8eeb8eea94ceb2c
SHA256ecc44a5368ce09243f61948793e8fecaa963639eb62bb90816438d5f6bd86683
SHA512dea47bd1a0224fa7e006b789c633b8387aa519b275564ecee48a00a7893cd379cabad968af383c6f32b9dd41c0615c686ce8a98e97fb22e09b27bb443b4c5e15
-
C:\Windows\SysWOW64\iplsafna\qovrqzxo.exeMD5
8a1d21936f9f97d05c2352c990af78ee
SHA19d507c149a1b7243d79ed5b1a8eeb8eea94ceb2c
SHA256ecc44a5368ce09243f61948793e8fecaa963639eb62bb90816438d5f6bd86683
SHA512dea47bd1a0224fa7e006b789c633b8387aa519b275564ecee48a00a7893cd379cabad968af383c6f32b9dd41c0615c686ce8a98e97fb22e09b27bb443b4c5e15
-
memory/336-7-0x0000000000000000-mapping.dmp
-
memory/740-5-0x0000000000000000-mapping.dmp
-
memory/840-9-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/840-10-0x0000000000089A6B-mapping.dmp
-
memory/1624-2-0x0000000000000000-mapping.dmp
-
memory/1784-3-0x0000000000000000-mapping.dmp
-
memory/1956-12-0x0000000000000000-mapping.dmp
-
memory/1996-6-0x0000000000000000-mapping.dmp