Analysis
-
max time kernel
185s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-04-2022 13:25
Static task
static1
Behavioral task
behavioral1
Sample
8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe
Resource
win7-20220414-en
General
-
Target
8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe
-
Size
203KB
-
MD5
40bd21b534a875137016dd1c93407366
-
SHA1
941dcff9464e407c060051475758f84e80998417
-
SHA256
8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a
-
SHA512
e5466a0c3b4e1c74192ee2db85bf3809904687934b6e2ffb2a1469b8f6510d03d80c948b364a67ed43fd4f753b29355dcb3252ecc073bca21e2880b4254ab31e
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
jqmvhq.exepid process 1924 jqmvhq.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 api.ipify.org 20 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exedescription ioc process File created C:\Windows\Tasks\jqmvhq.job 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe File opened for modification C:\Windows\Tasks\jqmvhq.job 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe -
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4808 4260 WerFault.exe 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe 4720 1924 WerFault.exe jqmvhq.exe 1968 1924 WerFault.exe jqmvhq.exe 2756 4260 WerFault.exe 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe 4380 4260 WerFault.exe 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe 3680 1924 WerFault.exe jqmvhq.exe 316 1924 WerFault.exe jqmvhq.exe 2380 4260 WerFault.exe 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exepid process 4260 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe 4260 8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe"C:\Users\Admin\AppData\Local\Temp\8e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 4882⤵
- Program crash
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 9442⤵
- Program crash
PID:2756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 9562⤵
- Program crash
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 9682⤵
- Program crash
PID:2380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4260 -ip 42601⤵PID:4368
-
C:\ProgramData\obnr\jqmvhq.exeC:\ProgramData\obnr\jqmvhq.exe start1⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 2402⤵
- Program crash
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 7722⤵
- Program crash
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 8442⤵
- Program crash
PID:3680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 7282⤵
- Program crash
PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1924 -ip 19241⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1924 -ip 19241⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4260 -ip 42601⤵PID:2764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4260 -ip 42601⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1924 -ip 19241⤵PID:1976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1924 -ip 19241⤵PID:2940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4260 -ip 42601⤵PID:4200
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\obnr\jqmvhq.exeFilesize
203KB
MD540bd21b534a875137016dd1c93407366
SHA1941dcff9464e407c060051475758f84e80998417
SHA2568e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a
SHA512e5466a0c3b4e1c74192ee2db85bf3809904687934b6e2ffb2a1469b8f6510d03d80c948b364a67ed43fd4f753b29355dcb3252ecc073bca21e2880b4254ab31e
-
C:\ProgramData\obnr\jqmvhq.exeFilesize
203KB
MD540bd21b534a875137016dd1c93407366
SHA1941dcff9464e407c060051475758f84e80998417
SHA2568e19fd66ec247a6ef30b5596bcf5ab7d615a12f0a79739117c1c88112c43968a
SHA512e5466a0c3b4e1c74192ee2db85bf3809904687934b6e2ffb2a1469b8f6510d03d80c948b364a67ed43fd4f753b29355dcb3252ecc073bca21e2880b4254ab31e
-
memory/1924-136-0x00000000025A5000-0x00000000025AB000-memory.dmpFilesize
24KB
-
memory/1924-137-0x00000000025A5000-0x00000000025AB000-memory.dmpFilesize
24KB
-
memory/1924-138-0x0000000000400000-0x00000000022EF000-memory.dmpFilesize
30.9MB
-
memory/4260-130-0x00000000026DA000-0x00000000026E0000-memory.dmpFilesize
24KB
-
memory/4260-131-0x00000000026DA000-0x00000000026E0000-memory.dmpFilesize
24KB
-
memory/4260-132-0x0000000002630000-0x0000000002639000-memory.dmpFilesize
36KB
-
memory/4260-133-0x0000000000400000-0x00000000022EF000-memory.dmpFilesize
30.9MB