Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-03-2022 00:30
Static task
static1
General
-
Target
e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe
-
Size
231KB
-
MD5
af6ec9ed07c5baa331323c30f874070a
-
SHA1
557507d8fe64a451c56c1daa4973944b3c4470fc
-
SHA256
e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
-
SHA512
d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
Malware Config
Extracted
systembc
31.44.185.6:4001
31.44.185.11:4001
Signatures
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
pqruus.exebjdwfx.exeakarrr.exepid process 1164 pqruus.exe 2436 bjdwfx.exe 2992 akarrr.exe -
Drops file in Windows directory 5 IoCs
Processes:
e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exepqruus.exebjdwfx.exedescription ioc process File created C:\Windows\Tasks\pqruus.job e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe File opened for modification C:\Windows\Tasks\pqruus.job e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe File created C:\Windows\Tasks\siowldeufmtfmwfvwip.job pqruus.exe File created C:\Windows\Tasks\akarrr.job bjdwfx.exe File opened for modification C:\Windows\Tasks\akarrr.job bjdwfx.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1952 224 WerFault.exe e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exebjdwfx.exepid process 224 e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe 224 e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe 2436 bjdwfx.exe 2436 bjdwfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe"C:\Users\Admin\AppData\Local\Temp\e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 4842⤵
- Program crash
PID:1952
-
C:\ProgramData\bslxq\pqruus.exeC:\ProgramData\bslxq\pqruus.exe start1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 224 -ip 2241⤵PID:1776
-
C:\Windows\TEMP\bjdwfx.exeC:\Windows\TEMP\bjdwfx.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
C:\ProgramData\nuhtnpd\akarrr.exeC:\ProgramData\nuhtnpd\akarrr.exe start1⤵
- Executes dropped EXE
PID:2992
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\bslxq\pqruus.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
C:\ProgramData\bslxq\pqruus.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
C:\ProgramData\nuhtnpd\akarrr.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
C:\ProgramData\nuhtnpd\akarrr.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
C:\Windows\TEMP\bjdwfx.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
C:\Windows\Tasks\pqruus.jobMD5
c49c59010fc62a60b5463a4e9b86538b
SHA1a4c762b80c26befdff08d9a4e732103139c57b64
SHA2568c0e710503c8d67b0d6590a2567cd56043173fbf3060ff5bc9f7c42a351cd233
SHA5124192000b8180cac895aa55b8a2cd3330986962554618287da696a1a9af8b1d847388ca1d5bbe4410374115f7096d5d2b9ffeda625084375f072d2250b9e5a120
-
C:\Windows\Temp\bjdwfx.exeMD5
af6ec9ed07c5baa331323c30f874070a
SHA1557507d8fe64a451c56c1daa4973944b3c4470fc
SHA256e4eeae87c2a1322dcca0411cb644fc416d3423d9236b3a94408214315d2a6699
SHA512d22727886e4532edb35aaaddd7de88d858028d9b4a0d13423934759c23f4a984e269e746a069682d23ed9f5cae575193df2c619465b699fd775152053c52defe
-
memory/224-134-0x0000000000669000-0x0000000000672000-memory.dmpFilesize
36KB
-
memory/224-135-0x0000000000600000-0x0000000000609000-memory.dmpFilesize
36KB
-
memory/224-136-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/224-133-0x0000000000669000-0x0000000000672000-memory.dmpFilesize
36KB
-
memory/1164-141-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1164-140-0x00000000005C5000-0x00000000005CD000-memory.dmpFilesize
32KB
-
memory/1164-139-0x00000000005C5000-0x00000000005CD000-memory.dmpFilesize
32KB
-
memory/2436-146-0x0000000000470000-0x0000000000570000-memory.dmpFilesize
1024KB
-
memory/2436-147-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2992-150-0x0000000000695000-0x000000000069D000-memory.dmpFilesize
32KB
-
memory/2992-151-0x0000000000695000-0x000000000069D000-memory.dmpFilesize
32KB
-
memory/2992-152-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB