Analysis
-
max time kernel
157s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-02-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe
-
Size
6.9MB
-
MD5
cce11037dcc8da69fd317c2a6f023593
-
SHA1
fbb6ea11adc7c4f9879f1be893e68ed62eb07aa2
-
SHA256
278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c
-
SHA512
761df8f0649053281ef105f8dad368cf9ba206fd10588a82b15fcfa7f103fac7210881979b2b553d197cd37586e94ce40dab8febecfb54ea2431c0a74a83d5ca
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 556 broserv.exe 1400 broserv.exe 2016 broserv.exe 1516 broserv.exe 1820 rfusclient.exe 1352 rfusclient.exe 1488 sys.exe 1904 rfusclient.exe -
resource yara_rule behavioral1/files/0x00050000000140fe-59.dat upx behavioral1/files/0x00050000000140fe-60.dat upx behavioral1/files/0x00050000000140fe-62.dat upx behavioral1/files/0x00050000000140fe-63.dat upx behavioral1/files/0x00050000000140fe-65.dat upx behavioral1/files/0x00050000000140fe-67.dat upx behavioral1/files/0x0005000000014115-72.dat upx behavioral1/files/0x0005000000014115-73.dat upx behavioral1/files/0x0005000000014115-74.dat upx behavioral1/files/0x0005000000014115-76.dat upx behavioral1/files/0x0005000000014051-78.dat upx behavioral1/files/0x0005000000014051-79.dat upx behavioral1/files/0x0005000000014115-84.dat upx -
Loads dropped DLL 3 IoCs
pid Process 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 1516 broserv.exe 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\WinHp\rfusclient.exe 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\regedit.reg 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\vp8encoder.dll 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\vp8decoder.dll 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File opened for modification C:\Program Files\WinHp 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\service.bat 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\sys.exe 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe File created C:\Program Files\WinHp\broserv.exe 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe -
Runs .reg file with regedit 2 IoCs
pid Process 516 regedit.exe 668 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 556 broserv.exe 556 broserv.exe 556 broserv.exe 556 broserv.exe 1400 broserv.exe 1400 broserv.exe 2016 broserv.exe 2016 broserv.exe 1516 broserv.exe 1516 broserv.exe 1516 broserv.exe 1516 broserv.exe 1820 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1904 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 556 broserv.exe Token: SeDebugPrivilege 2016 broserv.exe Token: SeTakeOwnershipPrivilege 1516 broserv.exe Token: SeTcbPrivilege 1516 broserv.exe Token: SeTcbPrivilege 1516 broserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 556 broserv.exe 1400 broserv.exe 2016 broserv.exe 1516 broserv.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1588 wrote to memory of 516 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 27 PID 1588 wrote to memory of 516 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 27 PID 1588 wrote to memory of 516 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 27 PID 1588 wrote to memory of 516 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 27 PID 1588 wrote to memory of 668 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 28 PID 1588 wrote to memory of 668 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 28 PID 1588 wrote to memory of 668 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 28 PID 1588 wrote to memory of 668 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 28 PID 1588 wrote to memory of 556 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 29 PID 1588 wrote to memory of 556 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 29 PID 1588 wrote to memory of 556 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 29 PID 1588 wrote to memory of 556 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 29 PID 1588 wrote to memory of 1400 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 30 PID 1588 wrote to memory of 1400 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 30 PID 1588 wrote to memory of 1400 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 30 PID 1588 wrote to memory of 1400 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 30 PID 1588 wrote to memory of 2016 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 31 PID 1588 wrote to memory of 2016 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 31 PID 1588 wrote to memory of 2016 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 31 PID 1588 wrote to memory of 2016 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 31 PID 1516 wrote to memory of 1820 1516 broserv.exe 33 PID 1516 wrote to memory of 1820 1516 broserv.exe 33 PID 1516 wrote to memory of 1820 1516 broserv.exe 33 PID 1516 wrote to memory of 1820 1516 broserv.exe 33 PID 1516 wrote to memory of 1352 1516 broserv.exe 34 PID 1516 wrote to memory of 1352 1516 broserv.exe 34 PID 1516 wrote to memory of 1352 1516 broserv.exe 34 PID 1516 wrote to memory of 1352 1516 broserv.exe 34 PID 1588 wrote to memory of 1488 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 35 PID 1588 wrote to memory of 1488 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 35 PID 1588 wrote to memory of 1488 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 35 PID 1588 wrote to memory of 1488 1588 278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe 35 PID 1820 wrote to memory of 1904 1820 rfusclient.exe 36 PID 1820 wrote to memory of 1904 1820 rfusclient.exe 36 PID 1820 wrote to memory of 1904 1820 rfusclient.exe 36 PID 1820 wrote to memory of 1904 1820 rfusclient.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe"C:\Users\Admin\AppData\Local\Temp\278ea5454555bd21fb861ed9085c7de78f9d59a2e851b47b1c098081688c595c.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Program Files\WinHp\regedit.reg"2⤵
- Runs .reg file with regedit
PID:516
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"2⤵
- Runs .reg file with regedit
PID:668
-
-
C:\Program Files\WinHp\broserv.exe"C:\Program Files\WinHp\broserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Program Files\WinHp\broserv.exe"C:\Program Files\WinHp\broserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Program Files\WinHp\broserv.exe"C:\Program Files\WinHp\broserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files\WinHp\sys.exe"C:\Program Files\WinHp\sys.exe"2⤵
- Executes dropped EXE
PID:1488
-
-
C:\Program Files\WinHp\broserv.exe"C:\Program Files\WinHp\broserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files\WinHp\rfusclient.exe"C:\Program Files\WinHp\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files\WinHp\rfusclient.exe"C:\Program Files\WinHp\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1904
-
-
-
C:\Program Files\WinHp\rfusclient.exe"C:\Program Files\WinHp\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1352
-