Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe
Resource
win10v2004-20220812-en
General
-
Target
bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe
-
Size
288KB
-
MD5
5eed71f51cafd4683a97fe06f2767c91
-
SHA1
f4f1ef528d190c1f3445869440c62ba123a4d414
-
SHA256
bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c
-
SHA512
9a54cf790104182b493a85153e3d8475c384ac998d72d6196aa4e1016e073b44df06bf77587d81a1d9300738580b7551140866d60120c17ac1e6dca3b83f7535
-
SSDEEP
3072:RFPx05fg+aK3+IXBtu9r5tMrwMxQtnhXINxBjPHmCqChvaik028V3G5Ms52kkr7k:HPxpKvRtsopxahYNxdHLh5k00on75G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1996 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe -
resource yara_rule behavioral1/memory/1996-60-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 1996 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe 1996 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 548 1996 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1168 wrote to memory of 1996 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 27 PID 1168 wrote to memory of 1996 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 27 PID 1168 wrote to memory of 1996 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 27 PID 1168 wrote to memory of 1996 1168 bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe"C:\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exeC:\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1003⤵
- Program crash
PID:548
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe
Filesize122KB
MD521a5c5dd712299717244b866a11908ea
SHA1f4fbf8a9da685b49bdb7e95776600144748a7b80
SHA256279f701051f98ef754d8657de303224ffee88d4c0f41cf9ecef6af4480087bcb
SHA512b91e9458219539a3df1a6cedd2bdda3821b9df5ac6123e1ade442084e6a5b38a9dd51f23d62671ffca7c59f91a9b0cbf0d56d1f93cae3338fbcd2e6d216980e7
-
\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe
Filesize122KB
MD521a5c5dd712299717244b866a11908ea
SHA1f4fbf8a9da685b49bdb7e95776600144748a7b80
SHA256279f701051f98ef754d8657de303224ffee88d4c0f41cf9ecef6af4480087bcb
SHA512b91e9458219539a3df1a6cedd2bdda3821b9df5ac6123e1ade442084e6a5b38a9dd51f23d62671ffca7c59f91a9b0cbf0d56d1f93cae3338fbcd2e6d216980e7
-
\Users\Admin\AppData\Local\Temp\bcf8e85b7d46d5069b99769b405ece5a7d187f7c5fc7d74f66b63721c17f050cmgr.exe
Filesize122KB
MD521a5c5dd712299717244b866a11908ea
SHA1f4fbf8a9da685b49bdb7e95776600144748a7b80
SHA256279f701051f98ef754d8657de303224ffee88d4c0f41cf9ecef6af4480087bcb
SHA512b91e9458219539a3df1a6cedd2bdda3821b9df5ac6123e1ade442084e6a5b38a9dd51f23d62671ffca7c59f91a9b0cbf0d56d1f93cae3338fbcd2e6d216980e7
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94