Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 13:36
Static task
static1
Behavioral task
behavioral1
Sample
0e7bc915182d2c168803acfaffb7fe9c.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0e7bc915182d2c168803acfaffb7fe9c.exe
Resource
win10v20201028
General
-
Target
0e7bc915182d2c168803acfaffb7fe9c.exe
-
Size
11.2MB
-
MD5
0e7bc915182d2c168803acfaffb7fe9c
-
SHA1
8a761cc25f05a8b61d8f509b5c34871466420e48
-
SHA256
9b70b8bd04c8ab2d25ebf024b23cbf44f541c6a835d0b0b4cd35e71c284baa14
-
SHA512
3b57cb0a86183bf91096844a3bbea5d4a1d1c8875c75776cb6f0b2ebfbd8579cfa7570d28c91d5a4bb24314607ab1f6e2c3a461aa0aaedc5190df28745d115c1
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ivhexkpz.exepid process 1772 ivhexkpz.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 660 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ivhexkpz.exedescription pid process target process PID 1772 set thread context of 660 1772 ivhexkpz.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
0e7bc915182d2c168803acfaffb7fe9c.exeivhexkpz.exedescription pid process target process PID 1320 wrote to memory of 1232 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1232 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1232 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1232 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1324 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1324 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1324 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1324 1320 0e7bc915182d2c168803acfaffb7fe9c.exe cmd.exe PID 1320 wrote to memory of 1952 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1952 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1952 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1952 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1424 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1424 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1424 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1424 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 572 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 572 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 572 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 572 1320 0e7bc915182d2c168803acfaffb7fe9c.exe sc.exe PID 1320 wrote to memory of 1620 1320 0e7bc915182d2c168803acfaffb7fe9c.exe netsh.exe PID 1320 wrote to memory of 1620 1320 0e7bc915182d2c168803acfaffb7fe9c.exe netsh.exe PID 1320 wrote to memory of 1620 1320 0e7bc915182d2c168803acfaffb7fe9c.exe netsh.exe PID 1320 wrote to memory of 1620 1320 0e7bc915182d2c168803acfaffb7fe9c.exe netsh.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe PID 1772 wrote to memory of 660 1772 ivhexkpz.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e7bc915182d2c168803acfaffb7fe9c.exe"C:\Users\Admin\AppData\Local\Temp\0e7bc915182d2c168803acfaffb7fe9c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kktwagga\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ivhexkpz.exe" C:\Windows\SysWOW64\kktwagga\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create kktwagga binPath= "C:\Windows\SysWOW64\kktwagga\ivhexkpz.exe /d\"C:\Users\Admin\AppData\Local\Temp\0e7bc915182d2c168803acfaffb7fe9c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description kktwagga "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start kktwagga2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\kktwagga\ivhexkpz.exeC:\Windows\SysWOW64\kktwagga\ivhexkpz.exe /d"C:\Users\Admin\AppData\Local\Temp\0e7bc915182d2c168803acfaffb7fe9c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ivhexkpz.exeMD5
56accc3ee5342115c745b84c9fa7fde2
SHA164c4b3bed4361b372282d0cd6fd801dcb8964abb
SHA256252c6f24529be1a178dadd156f538d9cef0a2138253cf9cb909602a96f29dafb
SHA512374860b915153c36bffbe1fea799b4cc7a4f4785cff3055a8eb3f9d972d7ca1137c8cacdc9f1331a124a8326d807e5d854871c4aa38e0c86ba799034c24a4b0b
-
C:\Windows\SysWOW64\kktwagga\ivhexkpz.exeMD5
56accc3ee5342115c745b84c9fa7fde2
SHA164c4b3bed4361b372282d0cd6fd801dcb8964abb
SHA256252c6f24529be1a178dadd156f538d9cef0a2138253cf9cb909602a96f29dafb
SHA512374860b915153c36bffbe1fea799b4cc7a4f4785cff3055a8eb3f9d972d7ca1137c8cacdc9f1331a124a8326d807e5d854871c4aa38e0c86ba799034c24a4b0b
-
memory/572-15-0x0000000000000000-mapping.dmp
-
memory/660-23-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/660-24-0x0000000000089A6B-mapping.dmp
-
memory/660-25-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1232-4-0x0000000000000000-mapping.dmp
-
memory/1320-3-0x0000000006160000-0x0000000006171000-memory.dmpFilesize
68KB
-
memory/1320-2-0x00000000047DB000-0x00000000047DC000-memory.dmpFilesize
4KB
-
memory/1324-5-0x0000000000000000-mapping.dmp
-
memory/1424-12-0x0000000000000000-mapping.dmp
-
memory/1620-19-0x0000000000000000-mapping.dmp
-
memory/1772-21-0x00000000047FB000-0x00000000047FC000-memory.dmpFilesize
4KB
-
memory/1772-22-0x0000000004D40000-0x0000000004D51000-memory.dmpFilesize
68KB
-
memory/1952-9-0x0000000000000000-mapping.dmp