Analysis
-
max time kernel
135s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-06-2021 09:49
Static task
static1
Behavioral task
behavioral1
Sample
b8e091ab0a94f3be56bbc2b66ccd653a.exe
Resource
win7v20210410
General
-
Target
b8e091ab0a94f3be56bbc2b66ccd653a.exe
-
Size
886KB
-
MD5
b8e091ab0a94f3be56bbc2b66ccd653a
-
SHA1
e62f75fcd271409e1c9eda1c60c0178247bbd3f7
-
SHA256
f7330d13166125485e745bcbe75e8c2af7423be00c70a0765610ca86d3b01eb1
-
SHA512
41a96833e498fa1fb8ab16e0e6bcd2df03d896f8460e0af6609ab757b91dd69f4394b8c676ed973a6f00545bd2c71c5a794ef9fb0bbf1f62942bddbb29db41e6
Malware Config
Extracted
systembc
88.198.147.80:4174
78.47.64.46:4174
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
ifrgw.exeifrgw.exepid process 2604 ifrgw.exe 1676 ifrgw.exe -
Drops file in Windows directory 5 IoCs
Processes:
ifrgw.exeb8e091ab0a94f3be56bbc2b66ccd653a.exeb8e091ab0a94f3be56bbc2b66ccd653a.exedescription ioc process File created C:\Windows\Tasks\wow64.job ifrgw.exe File opened for modification C:\Windows\Tasks\wow64.job ifrgw.exe File created C:\Windows\Tasks\wow64.job b8e091ab0a94f3be56bbc2b66ccd653a.exe File opened for modification C:\Windows\Tasks\wow64.job b8e091ab0a94f3be56bbc2b66ccd653a.exe File created C:\Windows\Tasks\mfqeroqpskmouwbrjld.job b8e091ab0a94f3be56bbc2b66ccd653a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe"C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exeC:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe start1⤵
- Drops file in Windows directory
-
C:\Windows\TEMP\ifrgw.exeC:\Windows\TEMP\ifrgw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\TEMP\ifrgw.exeC:\Windows\TEMP\ifrgw.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\TEMP\ifrgw.exeMD5
5fc8b735442c0761d95300c3ab2cd3f1
SHA10c68b66cd251825596f6a9dbcd9cd664401012c8
SHA25636373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d
SHA512a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797
-
C:\Windows\Tasks\wow64.jobMD5
39b57984ee59f5fbc189360391fcd9d3
SHA11b6a2753b40e0495ceaf1ea440fdef7dec08a002
SHA2567736095139c69dd0af0ddc575ada9c2ebad41261739dc30c0d38b2d567bbf131
SHA512281003197f22bb1fea8afb6f0c2b4b55cd45db371de311151b72d5a5a9590dc6acfa269d98618f3fe942c1426528faa4ace3a167289298d67dbb0c17be73cb56
-
C:\Windows\Temp\ifrgw.exeMD5
5fc8b735442c0761d95300c3ab2cd3f1
SHA10c68b66cd251825596f6a9dbcd9cd664401012c8
SHA25636373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d
SHA512a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797
-
C:\Windows\Temp\ifrgw.exeMD5
5fc8b735442c0761d95300c3ab2cd3f1
SHA10c68b66cd251825596f6a9dbcd9cd664401012c8
SHA25636373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d
SHA512a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797
-
memory/852-114-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/852-115-0x0000000002370000-0x0000000002375000-memory.dmpFilesize
20KB
-
memory/852-116-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/1676-128-0x00000000001D0000-0x00000000001F3000-memory.dmpFilesize
140KB
-
memory/1676-126-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2604-124-0x00000000001D0000-0x00000000001F3000-memory.dmpFilesize
140KB
-
memory/2604-127-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2856-119-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2856-117-0x00000000001D0000-0x00000000001F3000-memory.dmpFilesize
140KB