Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2022 14:30
Static task
static1
Behavioral task
behavioral1
Sample
xcfgsfaa.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
xcfgsfaa.exe
Resource
win10v2004-20220812-en
General
-
Target
xcfgsfaa.exe
-
Size
1.5MB
-
MD5
45fd8c84b44a20b4188de744bdf0a3f8
-
SHA1
37a13e9a7d5af87b82e55630fe78a8e12059dad5
-
SHA256
59f62f44fbd11163cb3eeb68f2b4606130dd8a01f569624ee4e4c50691c94391
-
SHA512
70e3fb0696ad94a98bef78b3fb5d8267596032eb5345b160a0820977e5a8988a382da01ff1b4eb140ac9e319f2dcf0ca7978bbb61b78880c9de5741a49fcddcf
-
SSDEEP
24576:Q4z87j9s0ML+6lvQ0QGTr8ZtkYa5yVke+MomAstHC7w3H79RBWKP:QvfWbLd7Y75+MomAstHC7wr5W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rfmfm.exepid process 4164 rfmfm.exe -
Processes:
resource yara_rule behavioral2/memory/664-140-0x0000000000700000-0x0000000000AE4000-memory.dmp upx behavioral2/memory/664-141-0x0000000000700000-0x0000000000AE4000-memory.dmp upx behavioral2/memory/3240-149-0x0000000000FA0000-0x0000000001384000-memory.dmp upx behavioral2/memory/3240-150-0x0000000000FA0000-0x0000000001384000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
xcfgsfaa.exerfmfm.exedescription pid process target process PID 1864 set thread context of 664 1864 xcfgsfaa.exe vbc.exe PID 4164 set thread context of 3240 4164 rfmfm.exe vbc.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3944 664 WerFault.exe vbc.exe 3532 664 WerFault.exe vbc.exe 8 3240 WerFault.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1444 schtasks.exe 2464 schtasks.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
xcfgsfaa.execmd.exerfmfm.execmd.exedescription pid process target process PID 1864 wrote to memory of 4992 1864 xcfgsfaa.exe cmd.exe PID 1864 wrote to memory of 4992 1864 xcfgsfaa.exe cmd.exe PID 1864 wrote to memory of 4992 1864 xcfgsfaa.exe cmd.exe PID 1864 wrote to memory of 4548 1864 xcfgsfaa.exe cmd.exe PID 1864 wrote to memory of 4548 1864 xcfgsfaa.exe cmd.exe PID 1864 wrote to memory of 4548 1864 xcfgsfaa.exe cmd.exe PID 4992 wrote to memory of 1444 4992 cmd.exe schtasks.exe PID 4992 wrote to memory of 1444 4992 cmd.exe schtasks.exe PID 4992 wrote to memory of 1444 4992 cmd.exe schtasks.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 1864 wrote to memory of 664 1864 xcfgsfaa.exe vbc.exe PID 4164 wrote to memory of 4608 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 4608 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 4608 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 716 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 716 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 716 4164 rfmfm.exe cmd.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4164 wrote to memory of 3240 4164 rfmfm.exe vbc.exe PID 4608 wrote to memory of 2464 4608 cmd.exe schtasks.exe PID 4608 wrote to memory of 2464 4608 cmd.exe schtasks.exe PID 4608 wrote to memory of 2464 4608 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xcfgsfaa.exe"C:\Users\Admin\AppData\Local\Temp\xcfgsfaa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\rfmfm.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\rfmfm.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\xcfgsfaa.exe" "C:\Users\Admin\AppData\Roaming\rfmfm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 664 -ip 6641⤵
-
C:\Users\Admin\AppData\Roaming\rfmfm.exeC:\Users\Admin\AppData\Roaming\rfmfm.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\rfmfm.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\rfmfm.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\rfmfm.exe" "C:\Users\Admin\AppData\Roaming\rfmfm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3240 -ip 32401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rfmfm.exeFilesize
1.5MB
MD545fd8c84b44a20b4188de744bdf0a3f8
SHA137a13e9a7d5af87b82e55630fe78a8e12059dad5
SHA25659f62f44fbd11163cb3eeb68f2b4606130dd8a01f569624ee4e4c50691c94391
SHA51270e3fb0696ad94a98bef78b3fb5d8267596032eb5345b160a0820977e5a8988a382da01ff1b4eb140ac9e319f2dcf0ca7978bbb61b78880c9de5741a49fcddcf
-
C:\Users\Admin\AppData\Roaming\rfmfm.exeFilesize
1.5MB
MD545fd8c84b44a20b4188de744bdf0a3f8
SHA137a13e9a7d5af87b82e55630fe78a8e12059dad5
SHA25659f62f44fbd11163cb3eeb68f2b4606130dd8a01f569624ee4e4c50691c94391
SHA51270e3fb0696ad94a98bef78b3fb5d8267596032eb5345b160a0820977e5a8988a382da01ff1b4eb140ac9e319f2dcf0ca7978bbb61b78880c9de5741a49fcddcf
-
memory/664-138-0x0000000000000000-mapping.dmp
-
memory/664-141-0x0000000000700000-0x0000000000AE4000-memory.dmpFilesize
3.9MB
-
memory/664-140-0x0000000000700000-0x0000000000AE4000-memory.dmpFilesize
3.9MB
-
memory/716-145-0x0000000000000000-mapping.dmp
-
memory/1444-137-0x0000000000000000-mapping.dmp
-
memory/1864-134-0x0000000005CB0000-0x0000000006254000-memory.dmpFilesize
5.6MB
-
memory/1864-133-0x0000000005450000-0x00000000054B6000-memory.dmpFilesize
408KB
-
memory/1864-132-0x00000000009B0000-0x0000000000B3A000-memory.dmpFilesize
1.5MB
-
memory/2464-147-0x0000000000000000-mapping.dmp
-
memory/3240-146-0x0000000000000000-mapping.dmp
-
memory/3240-149-0x0000000000FA0000-0x0000000001384000-memory.dmpFilesize
3.9MB
-
memory/3240-150-0x0000000000FA0000-0x0000000001384000-memory.dmpFilesize
3.9MB
-
memory/4548-136-0x0000000000000000-mapping.dmp
-
memory/4608-144-0x0000000000000000-mapping.dmp
-
memory/4992-135-0x0000000000000000-mapping.dmp