Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 13:21
Static task
static1
Behavioral task
behavioral1
Sample
00f168270e8ebf2584f151d7cc7236da.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
00f168270e8ebf2584f151d7cc7236da.exe
Resource
win10v20201028
General
-
Target
00f168270e8ebf2584f151d7cc7236da.exe
-
Size
11.7MB
-
MD5
00f168270e8ebf2584f151d7cc7236da
-
SHA1
527dac58289ec820691048cb320d65c01c193e65
-
SHA256
2603757f92034678ded0d4e72bbb78f2b29d6f7ee8f809b02d6056750fa579e4
-
SHA512
184b6b12d02c673dcc6d6c4f478fba8f8a5fd036fc94118ecbd490ef2735d7dd8aeee8132932e3ea43d5a45a02823d3c473a713037a4fd9c871723db6e350837
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
jlgxoipi.exepid process 1516 jlgxoipi.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1656 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jlgxoipi.exedescription pid process target process PID 1516 set thread context of 1656 1516 jlgxoipi.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
00f168270e8ebf2584f151d7cc7236da.exejlgxoipi.exedescription pid process target process PID 848 wrote to memory of 2000 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 2000 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 2000 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 2000 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 1788 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 1788 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 1788 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 1788 848 00f168270e8ebf2584f151d7cc7236da.exe cmd.exe PID 848 wrote to memory of 1488 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1488 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1488 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1488 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1624 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1624 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1624 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1624 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1836 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1836 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1836 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 848 wrote to memory of 1836 848 00f168270e8ebf2584f151d7cc7236da.exe sc.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 1516 wrote to memory of 1656 1516 jlgxoipi.exe svchost.exe PID 848 wrote to memory of 616 848 00f168270e8ebf2584f151d7cc7236da.exe netsh.exe PID 848 wrote to memory of 616 848 00f168270e8ebf2584f151d7cc7236da.exe netsh.exe PID 848 wrote to memory of 616 848 00f168270e8ebf2584f151d7cc7236da.exe netsh.exe PID 848 wrote to memory of 616 848 00f168270e8ebf2584f151d7cc7236da.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f168270e8ebf2584f151d7cc7236da.exe"C:\Users\Admin\AppData\Local\Temp\00f168270e8ebf2584f151d7cc7236da.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\adjeuxzu\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jlgxoipi.exe" C:\Windows\SysWOW64\adjeuxzu\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create adjeuxzu binPath= "C:\Windows\SysWOW64\adjeuxzu\jlgxoipi.exe /d\"C:\Users\Admin\AppData\Local\Temp\00f168270e8ebf2584f151d7cc7236da.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description adjeuxzu "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start adjeuxzu2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\adjeuxzu\jlgxoipi.exeC:\Windows\SysWOW64\adjeuxzu\jlgxoipi.exe /d"C:\Users\Admin\AppData\Local\Temp\00f168270e8ebf2584f151d7cc7236da.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jlgxoipi.exeMD5
4d51681c7dc7475da615b747ca49eb8d
SHA1489d1d2876d328306e64193266f0ac8452d05c57
SHA256467247ebe7a0e894fa860503104bbde312c4ed164ff96f2a565550d11d5cfc6a
SHA51218ebedaad5de946a55b9792a7b322e8282069315285f240bde37e20677efc4ed80ba6f3b11c73dd6762ce00555d6b3750aeb4bb5c9f0408b4cc630ef15707578
-
C:\Windows\SysWOW64\adjeuxzu\jlgxoipi.exeMD5
4d51681c7dc7475da615b747ca49eb8d
SHA1489d1d2876d328306e64193266f0ac8452d05c57
SHA256467247ebe7a0e894fa860503104bbde312c4ed164ff96f2a565550d11d5cfc6a
SHA51218ebedaad5de946a55b9792a7b322e8282069315285f240bde37e20677efc4ed80ba6f3b11c73dd6762ce00555d6b3750aeb4bb5c9f0408b4cc630ef15707578
-
memory/616-12-0x0000000000000000-mapping.dmp
-
memory/1488-5-0x0000000000000000-mapping.dmp
-
memory/1624-6-0x0000000000000000-mapping.dmp
-
memory/1656-9-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1656-10-0x0000000000089A6B-mapping.dmp
-
memory/1788-3-0x0000000000000000-mapping.dmp
-
memory/1836-7-0x0000000000000000-mapping.dmp
-
memory/2000-2-0x0000000000000000-mapping.dmp