Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
28-07-2022 14:19
Behavioral task
behavioral1
Sample
335b1296fa572b01158f7e8ef89c7064.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
335b1296fa572b01158f7e8ef89c7064.exe
Resource
win10v2004-20220721-en
General
-
Target
335b1296fa572b01158f7e8ef89c7064.exe
-
Size
479KB
-
MD5
335b1296fa572b01158f7e8ef89c7064
-
SHA1
4d41f80a6f2082acee991b6fdd830a3ae770ee6f
-
SHA256
4f660ee7d657778dc8c78514b1fa51f42decdfc61e1d609e6a7286ba2c20c70a
-
SHA512
a56e720d4ebcd2eab1949a796e6d46a355b6e507cda04f94d118543c95291b13802e24b118f7fe8dff26bc300fb5f7546ee73f9b7f1996453375b585a07b823e
Malware Config
Extracted
remcos
windows
newstub01.duckdns.org:1888
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
systemdll.exe
-
copy_folder
system
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
system
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
mutex-LK2O9P
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
windows
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MgQfxx.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\MgQfxx.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\MgQfxx.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\MgQfxx.exe aspack_v212_v242 -
Executes dropped EXE 2 IoCs
Processes:
MgQfxx.exesystemdll.exepid process 2020 MgQfxx.exe 1836 systemdll.exe -
Loads dropped DLL 4 IoCs
Processes:
335b1296fa572b01158f7e8ef89c7064.execmd.exepid process 1208 335b1296fa572b01158f7e8ef89c7064.exe 1208 335b1296fa572b01158f7e8ef89c7064.exe 268 cmd.exe 268 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
335b1296fa572b01158f7e8ef89c7064.exesystemdll.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 335b1296fa572b01158f7e8ef89c7064.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "\"C:\\Users\\Admin\\AppData\\Roaming\\system\\systemdll.exe\"" 335b1296fa572b01158f7e8ef89c7064.exe Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\ systemdll.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "\"C:\\Users\\Admin\\AppData\\Roaming\\system\\systemdll.exe\"" systemdll.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MgQfxx.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe MgQfxx.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe MgQfxx.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE MgQfxx.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe MgQfxx.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE MgQfxx.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe MgQfxx.exe File opened for modification C:\Program Files\7-Zip\7zG.exe MgQfxx.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe MgQfxx.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE MgQfxx.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe MgQfxx.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe MgQfxx.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe MgQfxx.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE MgQfxx.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe MgQfxx.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe MgQfxx.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe MgQfxx.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe MgQfxx.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe MgQfxx.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe MgQfxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE MgQfxx.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe MgQfxx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
systemdll.exepid process 1836 systemdll.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
335b1296fa572b01158f7e8ef89c7064.exeWScript.execmd.exeMgQfxx.exedescription pid process target process PID 1208 wrote to memory of 2020 1208 335b1296fa572b01158f7e8ef89c7064.exe MgQfxx.exe PID 1208 wrote to memory of 2020 1208 335b1296fa572b01158f7e8ef89c7064.exe MgQfxx.exe PID 1208 wrote to memory of 2020 1208 335b1296fa572b01158f7e8ef89c7064.exe MgQfxx.exe PID 1208 wrote to memory of 2020 1208 335b1296fa572b01158f7e8ef89c7064.exe MgQfxx.exe PID 1208 wrote to memory of 1168 1208 335b1296fa572b01158f7e8ef89c7064.exe WScript.exe PID 1208 wrote to memory of 1168 1208 335b1296fa572b01158f7e8ef89c7064.exe WScript.exe PID 1208 wrote to memory of 1168 1208 335b1296fa572b01158f7e8ef89c7064.exe WScript.exe PID 1208 wrote to memory of 1168 1208 335b1296fa572b01158f7e8ef89c7064.exe WScript.exe PID 1168 wrote to memory of 268 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 268 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 268 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 268 1168 WScript.exe cmd.exe PID 268 wrote to memory of 1836 268 cmd.exe systemdll.exe PID 268 wrote to memory of 1836 268 cmd.exe systemdll.exe PID 268 wrote to memory of 1836 268 cmd.exe systemdll.exe PID 268 wrote to memory of 1836 268 cmd.exe systemdll.exe PID 2020 wrote to memory of 1648 2020 MgQfxx.exe cmd.exe PID 2020 wrote to memory of 1648 2020 MgQfxx.exe cmd.exe PID 2020 wrote to memory of 1648 2020 MgQfxx.exe cmd.exe PID 2020 wrote to memory of 1648 2020 MgQfxx.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\335b1296fa572b01158f7e8ef89c7064.exe"C:\Users\Admin\AppData\Local\Temp\335b1296fa572b01158f7e8ef89c7064.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MgQfxx.exeC:\Users\Admin\AppData\Local\Temp\MgQfxx.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\29fd4ec4.bat" "3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\system\systemdll.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\systemdll.exeC:\Users\Admin\AppData\Roaming\system\systemdll.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\29fd4ec4.batFilesize
187B
MD5953637dc25f091f981ee5bd3eb4dfcc6
SHA1311308cf2397f4af8b68145b820a4148c7c2f20c
SHA2566c4c876872dd0e9e8c9af39e688765e62642c28938a5042c59a554432285aacc
SHA512d12a6436e64ac9b853f504badd18537bb7abd9ffc12bd05ad1e3eb69c145a690bd95d08cacbd8f3035145098072b97930bdc14d5a48610449c09497450460a41
-
C:\Users\Admin\AppData\Local\Temp\MgQfxx.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\MgQfxx.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
424B
MD5d4b1736d1323baf583b4a714186af443
SHA199d475eaeddeeae86429aa63741032c22569e9e4
SHA256e52e19416bf776679ddcc928e9859b69c9313234ab6ed82bfa2af33b90150b4d
SHA5122377b5ad6f006ba516faafe3239bd4617b8c571b87e5b24a7e6b675af7e8d3c4dcaffa4acb6b74c1d637a2352ad87b86b733b4ced689798d73817ce67d22c0b3
-
C:\Users\Admin\AppData\Roaming\system\systemdll.exeFilesize
479KB
MD5335b1296fa572b01158f7e8ef89c7064
SHA14d41f80a6f2082acee991b6fdd830a3ae770ee6f
SHA2564f660ee7d657778dc8c78514b1fa51f42decdfc61e1d609e6a7286ba2c20c70a
SHA512a56e720d4ebcd2eab1949a796e6d46a355b6e507cda04f94d118543c95291b13802e24b118f7fe8dff26bc300fb5f7546ee73f9b7f1996453375b585a07b823e
-
C:\Users\Admin\AppData\Roaming\system\systemdll.exeFilesize
479KB
MD5335b1296fa572b01158f7e8ef89c7064
SHA14d41f80a6f2082acee991b6fdd830a3ae770ee6f
SHA2564f660ee7d657778dc8c78514b1fa51f42decdfc61e1d609e6a7286ba2c20c70a
SHA512a56e720d4ebcd2eab1949a796e6d46a355b6e507cda04f94d118543c95291b13802e24b118f7fe8dff26bc300fb5f7546ee73f9b7f1996453375b585a07b823e
-
\Users\Admin\AppData\Local\Temp\MgQfxx.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\MgQfxx.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Roaming\system\systemdll.exeFilesize
479KB
MD5335b1296fa572b01158f7e8ef89c7064
SHA14d41f80a6f2082acee991b6fdd830a3ae770ee6f
SHA2564f660ee7d657778dc8c78514b1fa51f42decdfc61e1d609e6a7286ba2c20c70a
SHA512a56e720d4ebcd2eab1949a796e6d46a355b6e507cda04f94d118543c95291b13802e24b118f7fe8dff26bc300fb5f7546ee73f9b7f1996453375b585a07b823e
-
\Users\Admin\AppData\Roaming\system\systemdll.exeFilesize
479KB
MD5335b1296fa572b01158f7e8ef89c7064
SHA14d41f80a6f2082acee991b6fdd830a3ae770ee6f
SHA2564f660ee7d657778dc8c78514b1fa51f42decdfc61e1d609e6a7286ba2c20c70a
SHA512a56e720d4ebcd2eab1949a796e6d46a355b6e507cda04f94d118543c95291b13802e24b118f7fe8dff26bc300fb5f7546ee73f9b7f1996453375b585a07b823e
-
memory/268-72-0x0000000000160000-0x00000000001DF000-memory.dmpFilesize
508KB
-
memory/268-66-0x0000000000000000-mapping.dmp
-
memory/1168-61-0x0000000000000000-mapping.dmp
-
memory/1208-62-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1208-54-0x00000000758D1000-0x00000000758D3000-memory.dmpFilesize
8KB
-
memory/1648-76-0x0000000000000000-mapping.dmp
-
memory/1836-70-0x0000000000000000-mapping.dmp
-
memory/1836-74-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1836-75-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2020-65-0x0000000000E70000-0x0000000000E79000-memory.dmpFilesize
36KB
-
memory/2020-77-0x0000000000E70000-0x0000000000E79000-memory.dmpFilesize
36KB
-
memory/2020-57-0x0000000000000000-mapping.dmp