Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 06:49
Static task
static1
Behavioral task
behavioral1
Sample
a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe
Resource
win7-20220414-en
General
-
Target
a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe
-
Size
91KB
-
MD5
a2d3b46eda5ac1fa3e13d132cc8f57f0
-
SHA1
5f816267f2d1c0d32df65e85f6582673a7070f19
-
SHA256
a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61
-
SHA512
7127703dfe4d39e0b3fc59583cc322b517f40530170ef4936452a85618f2db97f65b4063b6c40d554c0719b440e7919e9ee9d56bd93bcf37420c90f10f4d1e8c
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
sfxefi.exepid process 304 sfxefi.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exedescription ioc process File created C:\Windows\Tasks\sfxefi.job a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe File opened for modification C:\Windows\Tasks\sfxefi.job a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exepid process 1944 a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 756 wrote to memory of 304 756 taskeng.exe sfxefi.exe PID 756 wrote to memory of 304 756 taskeng.exe sfxefi.exe PID 756 wrote to memory of 304 756 taskeng.exe sfxefi.exe PID 756 wrote to memory of 304 756 taskeng.exe sfxefi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe"C:\Users\Admin\AppData\Local\Temp\a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
C:\Windows\system32\taskeng.exetaskeng.exe {8DB69C48-AB3B-42D5-8C8D-F43074E0F592} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\ProgramData\vdrax\sfxefi.exeC:\ProgramData\vdrax\sfxefi.exe start2⤵
- Executes dropped EXE
PID:304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\vdrax\sfxefi.exeFilesize
91KB
MD5a2d3b46eda5ac1fa3e13d132cc8f57f0
SHA15f816267f2d1c0d32df65e85f6582673a7070f19
SHA256a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61
SHA5127127703dfe4d39e0b3fc59583cc322b517f40530170ef4936452a85618f2db97f65b4063b6c40d554c0719b440e7919e9ee9d56bd93bcf37420c90f10f4d1e8c
-
C:\ProgramData\vdrax\sfxefi.exeFilesize
91KB
MD5a2d3b46eda5ac1fa3e13d132cc8f57f0
SHA15f816267f2d1c0d32df65e85f6582673a7070f19
SHA256a7c6a1d224cf00ada45c4db86f9080e25965513f85c6ecd7b8d8d9c847b36c61
SHA5127127703dfe4d39e0b3fc59583cc322b517f40530170ef4936452a85618f2db97f65b4063b6c40d554c0719b440e7919e9ee9d56bd93bcf37420c90f10f4d1e8c
-
memory/304-60-0x0000000000000000-mapping.dmp
-
memory/304-62-0x000000000342B000-0x0000000003432000-memory.dmpFilesize
28KB
-
memory/304-64-0x000000000342B000-0x0000000003432000-memory.dmpFilesize
28KB
-
memory/304-65-0x0000000000400000-0x0000000002FA1000-memory.dmpFilesize
43.6MB
-
memory/1944-54-0x000000000312B000-0x0000000003132000-memory.dmpFilesize
28KB
-
memory/1944-55-0x0000000075DE1000-0x0000000075DE3000-memory.dmpFilesize
8KB
-
memory/1944-56-0x000000000312B000-0x0000000003132000-memory.dmpFilesize
28KB
-
memory/1944-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1944-58-0x0000000000400000-0x0000000002FA1000-memory.dmpFilesize
43.6MB