Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 14:47
Static task
static1
Behavioral task
behavioral1
Sample
c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe
Resource
win7-20220414-en
General
-
Target
c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe
-
Size
106KB
-
MD5
85fc0168e19390f9799ab42bfb1e3879
-
SHA1
25c56170f447f87f7fa8f2cf6a94c2916fc98047
-
SHA256
c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676
-
SHA512
852a3dd7cf1734ccd60808a9d60e771bb158a777464dc6cf53392fca098a4be97cf36d04a7955a694b8f4ce19e8232492fb4d56083ac16d7f4cded47dff581c1
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
smrhgng.exepid process 912 smrhgng.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 8 ip4.seeip.org 9 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exedescription ioc process File created C:\Windows\Tasks\smrhgng.job c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe File opened for modification C:\Windows\Tasks\smrhgng.job c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exepid process 1048 c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1692 wrote to memory of 912 1692 taskeng.exe smrhgng.exe PID 1692 wrote to memory of 912 1692 taskeng.exe smrhgng.exe PID 1692 wrote to memory of 912 1692 taskeng.exe smrhgng.exe PID 1692 wrote to memory of 912 1692 taskeng.exe smrhgng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe"C:\Users\Admin\AppData\Local\Temp\c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {4654F992-B594-4B7A-8E20-AA3ECEB21840} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kfkqwms\smrhgng.exeC:\ProgramData\kfkqwms\smrhgng.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\kfkqwms\smrhgng.exeFilesize
106KB
MD585fc0168e19390f9799ab42bfb1e3879
SHA125c56170f447f87f7fa8f2cf6a94c2916fc98047
SHA256c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676
SHA512852a3dd7cf1734ccd60808a9d60e771bb158a777464dc6cf53392fca098a4be97cf36d04a7955a694b8f4ce19e8232492fb4d56083ac16d7f4cded47dff581c1
-
C:\ProgramData\kfkqwms\smrhgng.exeFilesize
106KB
MD585fc0168e19390f9799ab42bfb1e3879
SHA125c56170f447f87f7fa8f2cf6a94c2916fc98047
SHA256c3c48782f893bd61e1102c3095b8c3f7ed842e3e6889ee026d581c5dd1637676
SHA512852a3dd7cf1734ccd60808a9d60e771bb158a777464dc6cf53392fca098a4be97cf36d04a7955a694b8f4ce19e8232492fb4d56083ac16d7f4cded47dff581c1
-
memory/912-59-0x0000000000000000-mapping.dmp
-
memory/912-63-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/912-62-0x000000000061B000-0x0000000000621000-memory.dmpFilesize
24KB
-
memory/912-64-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/1048-54-0x00000000006CB000-0x00000000006D2000-memory.dmpFilesize
28KB
-
memory/1048-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1048-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1048-57-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB