Analysis
-
max time kernel
164s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 06:09
Static task
static1
Behavioral task
behavioral1
Sample
3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe
Resource
win7-20220414-en
General
-
Target
3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe
-
Size
264KB
-
MD5
05206e5eda097f54b8b1bcf23891ad80
-
SHA1
2325f3f2a146432526208e733718dff80a65e86e
-
SHA256
3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9
-
SHA512
df1a8558357d4b7aa9b812f5f078fa6dc00584c3b5413ea13087cb5d156f3b5d202d56a50925860dd00ebb7d4c6108d100384f68638b07415e5e569282e32879
Malware Config
Extracted
systembc
172.104.63.157:4001
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cvxn.exepid process 2032 cvxn.exe -
Drops file in Windows directory 2 IoCs
Processes:
3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exedescription ioc process File created C:\Windows\Tasks\cvxn.job 3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe File opened for modification C:\Windows\Tasks\cvxn.job 3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exepid process 964 3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1224 wrote to memory of 2032 1224 taskeng.exe cvxn.exe PID 1224 wrote to memory of 2032 1224 taskeng.exe cvxn.exe PID 1224 wrote to memory of 2032 1224 taskeng.exe cvxn.exe PID 1224 wrote to memory of 2032 1224 taskeng.exe cvxn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe"C:\Users\Admin\AppData\Local\Temp\3ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:964
-
C:\Windows\system32\taskeng.exetaskeng.exe {76699236-F41B-471E-AEE6-27221BE7FFA3} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\ProgramData\bnjoqmx\cvxn.exeC:\ProgramData\bnjoqmx\cvxn.exe start2⤵
- Executes dropped EXE
PID:2032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\bnjoqmx\cvxn.exeFilesize
264KB
MD505206e5eda097f54b8b1bcf23891ad80
SHA12325f3f2a146432526208e733718dff80a65e86e
SHA2563ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9
SHA512df1a8558357d4b7aa9b812f5f078fa6dc00584c3b5413ea13087cb5d156f3b5d202d56a50925860dd00ebb7d4c6108d100384f68638b07415e5e569282e32879
-
C:\ProgramData\bnjoqmx\cvxn.exeFilesize
264KB
MD505206e5eda097f54b8b1bcf23891ad80
SHA12325f3f2a146432526208e733718dff80a65e86e
SHA2563ef8f893bfba60ce3d400e7437856b813fcf69b24a1c37848963d052ecd0d9f9
SHA512df1a8558357d4b7aa9b812f5f078fa6dc00584c3b5413ea13087cb5d156f3b5d202d56a50925860dd00ebb7d4c6108d100384f68638b07415e5e569282e32879
-
memory/964-54-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/964-55-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/964-57-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/964-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2032-59-0x0000000000000000-mapping.dmp