Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 15:10
Static task
static1
Behavioral task
behavioral1
Sample
75c5cd21845d8d6b715fb5c86b58c5c7.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
75c5cd21845d8d6b715fb5c86b58c5c7.exe
Resource
win10v20201028
General
-
Target
75c5cd21845d8d6b715fb5c86b58c5c7.exe
-
Size
11.0MB
-
MD5
75c5cd21845d8d6b715fb5c86b58c5c7
-
SHA1
492058c37438a6b93fa3c033b0b94c62af4cf7a7
-
SHA256
7d89ddfb70a2246032a1ed4b908f7311f2808e11299967f08af6c748d336010a
-
SHA512
d48abfcfddc8ab60efd35296dab49d7f3bfad4cf11a79fd58ab0824fddbd2e6993bf2164ae70f145d69907090cc9c2b4bb6987c4942030031944fe73f5b0d7fe
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
pflefndm.exepid process 1088 pflefndm.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 556 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pflefndm.exedescription pid process target process PID 1088 set thread context of 556 1088 pflefndm.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
75c5cd21845d8d6b715fb5c86b58c5c7.exepflefndm.exedescription pid process target process PID 1668 wrote to memory of 1168 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1168 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1168 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1168 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1368 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1368 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1368 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 1368 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe cmd.exe PID 1668 wrote to memory of 316 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 316 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 316 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 316 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 1556 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 1556 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 1556 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 1556 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 892 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 892 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 892 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 892 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe sc.exe PID 1668 wrote to memory of 1512 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe netsh.exe PID 1668 wrote to memory of 1512 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe netsh.exe PID 1668 wrote to memory of 1512 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe netsh.exe PID 1668 wrote to memory of 1512 1668 75c5cd21845d8d6b715fb5c86b58c5c7.exe netsh.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe PID 1088 wrote to memory of 556 1088 pflefndm.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c5cd21845d8d6b715fb5c86b58c5c7.exe"C:\Users\Admin\AppData\Local\Temp\75c5cd21845d8d6b715fb5c86b58c5c7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qbbyrnwe\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pflefndm.exe" C:\Windows\SysWOW64\qbbyrnwe\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qbbyrnwe binPath= "C:\Windows\SysWOW64\qbbyrnwe\pflefndm.exe /d\"C:\Users\Admin\AppData\Local\Temp\75c5cd21845d8d6b715fb5c86b58c5c7.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qbbyrnwe "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qbbyrnwe2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\qbbyrnwe\pflefndm.exeC:\Windows\SysWOW64\qbbyrnwe\pflefndm.exe /d"C:\Users\Admin\AppData\Local\Temp\75c5cd21845d8d6b715fb5c86b58c5c7.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pflefndm.exeMD5
25614d5e015ecc51284ed4f1884c4b50
SHA14fa844645aded26147f11203dab53b34cfefd282
SHA256708a62dc5b180558d8addb0a708f19f8ba1cb5e75814ec7cd8cbf3ccca8e3481
SHA512bc1786de64c6c81ddab19e03414925f59256556139c8d70c8a076e2370ab31e1639b3ee1f9fc02307d9b0060759a093c0bec1062744d630c836e92c346cd5cd5
-
C:\Windows\SysWOW64\qbbyrnwe\pflefndm.exeMD5
25614d5e015ecc51284ed4f1884c4b50
SHA14fa844645aded26147f11203dab53b34cfefd282
SHA256708a62dc5b180558d8addb0a708f19f8ba1cb5e75814ec7cd8cbf3ccca8e3481
SHA512bc1786de64c6c81ddab19e03414925f59256556139c8d70c8a076e2370ab31e1639b3ee1f9fc02307d9b0060759a093c0bec1062744d630c836e92c346cd5cd5
-
memory/316-5-0x0000000000000000-mapping.dmp
-
memory/556-10-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/556-11-0x0000000000089A6B-mapping.dmp
-
memory/556-12-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/892-7-0x0000000000000000-mapping.dmp
-
memory/1168-2-0x0000000000000000-mapping.dmp
-
memory/1368-3-0x0000000000000000-mapping.dmp
-
memory/1512-8-0x0000000000000000-mapping.dmp
-
memory/1556-6-0x0000000000000000-mapping.dmp