Analysis
-
max time kernel
153s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-05-2022 05:54
Static task
static1
Behavioral task
behavioral1
Sample
3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe
Resource
win7-20220414-en
General
-
Target
3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe
-
Size
94KB
-
MD5
8d63b4b33f84d55f999fe7f2c07f1898
-
SHA1
4b72592eb314d60c52e7dc13a4c99b5afb902bf3
-
SHA256
3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e
-
SHA512
d734614ccba6dd7f3e84e5a39484a45bead737f3d27ab7dbc62654c5a7ea96133c68b02f0e63a073e29105a05ebd2120dd2156d63c901eabad096c65a0e7f263
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
avod.exepid process 1148 avod.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exedescription ioc process File created C:\Windows\Tasks\avod.job 3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe File opened for modification C:\Windows\Tasks\avod.job 3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exepid process 1668 3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 952 wrote to memory of 1148 952 taskeng.exe avod.exe PID 952 wrote to memory of 1148 952 taskeng.exe avod.exe PID 952 wrote to memory of 1148 952 taskeng.exe avod.exe PID 952 wrote to memory of 1148 952 taskeng.exe avod.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe"C:\Users\Admin\AppData\Local\Temp\3c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {A7979D5F-0711-46B1-A203-637D0A0A55B5} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\sgnrhh\avod.exeC:\ProgramData\sgnrhh\avod.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\sgnrhh\avod.exeFilesize
94KB
MD58d63b4b33f84d55f999fe7f2c07f1898
SHA14b72592eb314d60c52e7dc13a4c99b5afb902bf3
SHA2563c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e
SHA512d734614ccba6dd7f3e84e5a39484a45bead737f3d27ab7dbc62654c5a7ea96133c68b02f0e63a073e29105a05ebd2120dd2156d63c901eabad096c65a0e7f263
-
C:\ProgramData\sgnrhh\avod.exeFilesize
94KB
MD58d63b4b33f84d55f999fe7f2c07f1898
SHA14b72592eb314d60c52e7dc13a4c99b5afb902bf3
SHA2563c8bd18b6c4245a7a6279de001da2ae03504a0060e9b61378836dbaf9d6d940e
SHA512d734614ccba6dd7f3e84e5a39484a45bead737f3d27ab7dbc62654c5a7ea96133c68b02f0e63a073e29105a05ebd2120dd2156d63c901eabad096c65a0e7f263
-
memory/1148-60-0x0000000000000000-mapping.dmp
-
memory/1148-62-0x0000000001118000-0x000000000111F000-memory.dmpFilesize
28KB
-
memory/1148-64-0x0000000001118000-0x000000000111F000-memory.dmpFilesize
28KB
-
memory/1148-65-0x0000000000400000-0x0000000000F75000-memory.dmpFilesize
11.5MB
-
memory/1668-54-0x00000000002C8000-0x00000000002CF000-memory.dmpFilesize
28KB
-
memory/1668-55-0x0000000075371000-0x0000000075373000-memory.dmpFilesize
8KB
-
memory/1668-56-0x00000000002C8000-0x00000000002CF000-memory.dmpFilesize
28KB
-
memory/1668-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1668-58-0x0000000000400000-0x0000000000F75000-memory.dmpFilesize
11.5MB