Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 14:04
Static task
static1
General
-
Target
79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe
-
Size
223KB
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
-
SHA1
5a7465ca0541374f63cf1a8587ec44184b6109b7
-
SHA256
79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
-
SHA512
a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
Malware Config
Extracted
systembc
31.44.185.6:4001
31.44.185.11:4001
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
nqmw.exexdrb.exedcdtvg.exepid process 4660 nqmw.exe 796 xdrb.exe 3788 dcdtvg.exe -
Drops file in Windows directory 5 IoCs
Processes:
nqmw.exexdrb.exe79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exedescription ioc process File created C:\Windows\Tasks\gqrbaotjfdikfwdonjx.job nqmw.exe File created C:\Windows\Tasks\dcdtvg.job xdrb.exe File opened for modification C:\Windows\Tasks\dcdtvg.job xdrb.exe File created C:\Windows\Tasks\nqmw.job 79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe File opened for modification C:\Windows\Tasks\nqmw.job 79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3660 1888 WerFault.exe 79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exexdrb.exepid process 1888 79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe 1888 79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe 796 xdrb.exe 796 xdrb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe"C:\Users\Admin\AppData\Local\Temp\79edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 4842⤵
- Program crash
PID:3660
-
-
C:\ProgramData\sgeu\nqmw.exeC:\ProgramData\sgeu\nqmw.exe start1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1888 -ip 18881⤵PID:4192
-
C:\Windows\TEMP\xdrb.exeC:\Windows\TEMP\xdrb.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:796
-
C:\ProgramData\shvfv\dcdtvg.exeC:\ProgramData\shvfv\dcdtvg.exe start1⤵
- Executes dropped EXE
PID:3788
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41
-
MD5
bebae4bd2b27f97a618380c219dcd60c
SHA1c3417ddd9a95e0c4d6cad4ed9cf3f8700971ccfc
SHA25658d2a5b4c0192f57eee9bbcae03f1be3f00597aa34757f7cfd262bfa782c3b08
SHA51210d4dbca5aae217b66079cfd36577f4f13da60ea13d9286be13454f8ddd4d4c15b7dfedf3f55b9a66d5b5f9a6909159ca98e7f87ead8a0f0640479d07635da72
-
MD5
a0e7217dd5f2bc9173909d48dae3fbab
SHA15a7465ca0541374f63cf1a8587ec44184b6109b7
SHA25679edc7bfd3e3b2c209ccbd32b32653d7b3613d9b586190e64ac44e05e745676f
SHA512a756ed124f5a4354c2dabec14222d27fa0583b2c4bad305ad350713e207db351d12592cced859d1376fceea5f4342ff863210d8d90e94d18660fe6c7aebd3d41