Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
12-03-2022 18:20
Static task
static1
General
-
Target
7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe
-
Size
232KB
-
MD5
21a3edbe9b154013a16776a80e95425d
-
SHA1
c402b0c9014745a45315672a81789fa924e64377
-
SHA256
7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
-
SHA512
969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
Malware Config
Extracted
systembc
31.44.185.6:4001
31.44.185.11:4001
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
gjpue.exepbismek.execsdjrxl.exepid process 1152 gjpue.exe 5060 pbismek.exe 3616 csdjrxl.exe -
Drops file in Windows directory 5 IoCs
Processes:
7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exegjpue.exepbismek.exedescription ioc process File created C:\Windows\Tasks\gjpue.job 7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe File opened for modification C:\Windows\Tasks\gjpue.job 7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe File created C:\Windows\Tasks\isfkjhecwvsqnligcbw.job gjpue.exe File created C:\Windows\Tasks\csdjrxl.job pbismek.exe File opened for modification C:\Windows\Tasks\csdjrxl.job pbismek.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1132 3668 WerFault.exe 7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exepbismek.exepid process 3668 7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe 3668 7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe 5060 pbismek.exe 5060 pbismek.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe"C:\Users\Admin\AppData\Local\Temp\7b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 4842⤵
- Program crash
PID:1132
-
C:\ProgramData\hgcxk\gjpue.exeC:\ProgramData\hgcxk\gjpue.exe start1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3668 -ip 36681⤵PID:408
-
C:\Windows\TEMP\pbismek.exeC:\Windows\TEMP\pbismek.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
C:\ProgramData\nifi\csdjrxl.exeC:\ProgramData\nifi\csdjrxl.exe start1⤵
- Executes dropped EXE
PID:3616
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hgcxk\gjpue.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
C:\ProgramData\hgcxk\gjpue.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
C:\ProgramData\nifi\csdjrxl.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
C:\ProgramData\nifi\csdjrxl.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
C:\Windows\TEMP\pbismek.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
C:\Windows\Tasks\gjpue.jobMD5
6b8c3e629e6e4906aecbda7f655017ef
SHA1a7885410e12621ab90bee8589bd6ae83d0ba7ddf
SHA2561f8dfda8e335cec3cc4d79abcef97959c206fec599229cd455892d70c20886d9
SHA5123ae938ddaf575787ddfbc033b6334a6d96fcefa47dec4cf9dc068ec139f5a974cbf74c6ec74827560a7dd588f793bcd9e1c66871e4de940eb632b5f4104c394e
-
C:\Windows\Temp\pbismek.exeMD5
21a3edbe9b154013a16776a80e95425d
SHA1c402b0c9014745a45315672a81789fa924e64377
SHA2567b2cf05c070a54a9271d765425aa0af47d2445b80baf73963de28a847eefff6e
SHA512969024b1a457ad2fd683c935311d3de44aef43d33a394d270b1f03819580eced23ac252d543270b040955b9bf3cbf68f8c03df007b9195b157e4b3bd671c3f88
-
memory/1152-136-0x00000000004E5000-0x00000000004EE000-memory.dmpFilesize
36KB
-
memory/1152-137-0x00000000004E5000-0x00000000004EE000-memory.dmpFilesize
36KB
-
memory/1152-138-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3616-149-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3616-148-0x0000000000665000-0x000000000066E000-memory.dmpFilesize
36KB
-
memory/3616-147-0x0000000000665000-0x000000000066E000-memory.dmpFilesize
36KB
-
memory/3668-130-0x00000000005A9000-0x00000000005B2000-memory.dmpFilesize
36KB
-
memory/3668-133-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3668-131-0x00000000005A9000-0x00000000005B2000-memory.dmpFilesize
36KB
-
memory/3668-132-0x00000000021A0000-0x00000000021A9000-memory.dmpFilesize
36KB
-
memory/5060-144-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/5060-143-0x0000000000645000-0x000000000064E000-memory.dmpFilesize
36KB
-
memory/5060-141-0x0000000000645000-0x000000000064E000-memory.dmpFilesize
36KB