6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311

General

Target

6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
Size

168KB
MD5

06d2604626aeb27c88352c8b44a4d517
SHA1

da0a332369b46ebb9d1c8abdb9e9c981c2a83fc4
SHA256

6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311
SHA512

4f14528ee2794e28a66ff4d935d81563bbe9d7340ff84a985a464d33925d6bf9314a12df28feae13a415a310e70ebabd12b6b2a92db7638c7ce738f93ccd350d
SSDEEP

768:yIz9MkP55h/D9YTR/PIC9b+NmssiAYoYulwv1:yNkP7h/D9YLcmCoYuK

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3068	svshosts.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File opened for modification	C:\Windows\SysWOW64\svshosts.exe	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe
File created	C:\Windows\SysWOW64\svshosts.exe\svshosts.exe\svshosts.exe\svshosts.exe	svshosts.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2052	3068	WerFault.exe	81
4832	3068	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2284	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
2284	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
3068	svshosts.exe
3068	svshosts.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3068	2284	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe	81
PID 2284 wrote to memory of 3068	2284	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe	81
PID 2284 wrote to memory of 3068	2284	6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe	81

C:\Users\Admin\AppData\Local\Temp\6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe
"C:\Users\Admin\AppData\Local\Temp\6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\svshosts.exe
  C:\Windows\system32\svshosts.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1048
    3⤵
    - Program crash
    PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1044
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3068 -ip 3068
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3068 -ip 3068
1⤵
PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svshosts.exe

Filesize
168KB

MD5
06d2604626aeb27c88352c8b44a4d517

SHA1
da0a332369b46ebb9d1c8abdb9e9c981c2a83fc4

SHA256
6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311

SHA512
4f14528ee2794e28a66ff4d935d81563bbe9d7340ff84a985a464d33925d6bf9314a12df28feae13a415a310e70ebabd12b6b2a92db7638c7ce738f93ccd350d

Download Submit
C:\Windows\SysWOW64\svshosts.exe

Filesize
168KB

MD5
06d2604626aeb27c88352c8b44a4d517

SHA1
da0a332369b46ebb9d1c8abdb9e9c981c2a83fc4

SHA256
6f19eb18eddf29a1801e18ab64d662b0aca7c026fadcc3e90488c3149fd7f311

SHA512
4f14528ee2794e28a66ff4d935d81563bbe9d7340ff84a985a464d33925d6bf9314a12df28feae13a415a310e70ebabd12b6b2a92db7638c7ce738f93ccd350d

Download Submit
memory/2284-132-0x0000000000400000-0x000000000042A03C-memory.dmp

Filesize
168KB

Download
memory/2284-136-0x0000000000400000-0x000000000042A03C-memory.dmp

Filesize
168KB

Download
memory/3068-133-0x0000000000000000-mapping.dmp

Download
memory/3068-137-0x0000000000400000-0x000000000042A03C-memory.dmp

Filesize
168KB

Download

Analysis

Sharing