Analysis
-
max time kernel
115s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe
Resource
win7-20220414-en
General
-
Target
3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe
-
Size
267KB
-
MD5
e213b1c3dc9cb0f7771d299d2cf7a346
-
SHA1
85229bc75fb370973c78afef7409554bc891dcf1
-
SHA256
3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7
-
SHA512
9bd45559c7da861711a8f706a8c2b5dc83916ff44f988ea86eb8794daf128b5ad426b954ff58356cfc521c165fb129bdbeafe286d4184250ca66b621125514e4
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
txrhvch.exepid process 2024 txrhvch.exe -
Drops file in Windows directory 2 IoCs
Processes:
3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exedescription ioc process File created C:\Windows\Tasks\txrhvch.job 3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe File opened for modification C:\Windows\Tasks\txrhvch.job 3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exepid process 452 3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1092 wrote to memory of 2024 1092 taskeng.exe txrhvch.exe PID 1092 wrote to memory of 2024 1092 taskeng.exe txrhvch.exe PID 1092 wrote to memory of 2024 1092 taskeng.exe txrhvch.exe PID 1092 wrote to memory of 2024 1092 taskeng.exe txrhvch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe"C:\Users\Admin\AppData\Local\Temp\3d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {AE9C13B4-812B-4566-83B5-17F94AA83FD8} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\uxilffe\txrhvch.exeC:\ProgramData\uxilffe\txrhvch.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\uxilffe\txrhvch.exeFilesize
267KB
MD5e213b1c3dc9cb0f7771d299d2cf7a346
SHA185229bc75fb370973c78afef7409554bc891dcf1
SHA2563d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7
SHA5129bd45559c7da861711a8f706a8c2b5dc83916ff44f988ea86eb8794daf128b5ad426b954ff58356cfc521c165fb129bdbeafe286d4184250ca66b621125514e4
-
C:\ProgramData\uxilffe\txrhvch.exeFilesize
267KB
MD5e213b1c3dc9cb0f7771d299d2cf7a346
SHA185229bc75fb370973c78afef7409554bc891dcf1
SHA2563d2a6335cf267e52f65d919aeea421c75f47878f4139a80842080485b72d2ac7
SHA5129bd45559c7da861711a8f706a8c2b5dc83916ff44f988ea86eb8794daf128b5ad426b954ff58356cfc521c165fb129bdbeafe286d4184250ca66b621125514e4
-
memory/452-54-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/452-55-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/452-56-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/452-57-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/2024-59-0x0000000000000000-mapping.dmp