Analysis
-
max time kernel
4294214s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 10:55
Static task
static1
Behavioral task
behavioral1
Sample
bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe
Resource
win7-20220311-en
General
-
Target
bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe
-
Size
234KB
-
MD5
f36c144d3572825d5a4bbe01fc6b2e5f
-
SHA1
13c0276832e96446fc927cf77b057194a7326cc6
-
SHA256
bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd
-
SHA512
666346ee29abf0caa8314226c421a2ca358d8239ecc59c8e7b5ebe8fdeb2ccb0fab39f528c5bd0042d47dfcf2061e99c36363b10ef905e48f4ad129574ca7181
Malware Config
Extracted
systembc
dec15coma.com:4039
dec15coma.xyz:4039
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wowlx.exepid process 268 wowlx.exe -
Processes:
resource yara_rule C:\ProgramData\slvhs\wowlx.exe upx C:\ProgramData\slvhs\wowlx.exe upx -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip4.seeip.org 8 ip4.seeip.org 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exedescription ioc process File created C:\Windows\Tasks\wowlx.job bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe File opened for modification C:\Windows\Tasks\wowlx.job bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exepid process 1988 bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1792 wrote to memory of 268 1792 taskeng.exe wowlx.exe PID 1792 wrote to memory of 268 1792 taskeng.exe wowlx.exe PID 1792 wrote to memory of 268 1792 taskeng.exe wowlx.exe PID 1792 wrote to memory of 268 1792 taskeng.exe wowlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe"C:\Users\Admin\AppData\Local\Temp\bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
C:\Windows\system32\taskeng.exetaskeng.exe {0C10CC04-5E2D-42FE-BB05-291C4C2EE762} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\ProgramData\slvhs\wowlx.exeC:\ProgramData\slvhs\wowlx.exe start2⤵
- Executes dropped EXE
PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\slvhs\wowlx.exeMD5
f36c144d3572825d5a4bbe01fc6b2e5f
SHA113c0276832e96446fc927cf77b057194a7326cc6
SHA256bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd
SHA512666346ee29abf0caa8314226c421a2ca358d8239ecc59c8e7b5ebe8fdeb2ccb0fab39f528c5bd0042d47dfcf2061e99c36363b10ef905e48f4ad129574ca7181
-
C:\ProgramData\slvhs\wowlx.exeMD5
f36c144d3572825d5a4bbe01fc6b2e5f
SHA113c0276832e96446fc927cf77b057194a7326cc6
SHA256bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd
SHA512666346ee29abf0caa8314226c421a2ca358d8239ecc59c8e7b5ebe8fdeb2ccb0fab39f528c5bd0042d47dfcf2061e99c36363b10ef905e48f4ad129574ca7181
-
memory/268-61-0x0000000005288000-0x000000000528F000-memory.dmpFilesize
28KB
-
memory/268-64-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/268-63-0x0000000005288000-0x000000000528F000-memory.dmpFilesize
28KB
-
memory/268-65-0x0000000000400000-0x0000000005163000-memory.dmpFilesize
77.4MB
-
memory/1988-54-0x00000000055E9000-0x00000000055EF000-memory.dmpFilesize
24KB
-
memory/1988-55-0x00000000055E9000-0x00000000055EF000-memory.dmpFilesize
24KB
-
memory/1988-56-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1988-57-0x0000000076BC1000-0x0000000076BC3000-memory.dmpFilesize
8KB
-
memory/1988-58-0x0000000000400000-0x0000000005163000-memory.dmpFilesize
77.4MB