Analysis
-
max time kernel
103s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-12-2022 08:24
Behavioral task
behavioral1
Sample
83514393db26424b554847acb66e57c2.exe
Resource
win7-20220812-en
General
-
Target
83514393db26424b554847acb66e57c2.exe
-
Size
109KB
-
MD5
83514393db26424b554847acb66e57c2
-
SHA1
f011dac01e0e0552c2f42665e444cab907394353
-
SHA256
609107e7e71a4899fa5496da826c92a2ca05134e7f79b0bbda280696de45f937
-
SHA512
5899f1f574e8ae7f607267ada11b193ec5662a437d4db30aa2804f682779fa493369109aea27c57d6a8f190cd74ace17507df9ec06cabb235cb5b8453448de59
-
SSDEEP
3072:z4CKjfWVRLecKlAG1OCRpwI1KCnLAHa15:yW7ZUO+OIUCLAHa15
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
kdwsvi.exekdwsvi.exepid process 1632 kdwsvi.exe 1968 kdwsvi.exe -
Processes:
resource yara_rule C:\ProgramData\bvqsw\kdwsvi.exe upx C:\ProgramData\bvqsw\kdwsvi.exe upx behavioral1/memory/1632-61-0x0000000000400000-0x000000000044A000-memory.dmp upx C:\ProgramData\bvqsw\kdwsvi.exe upx behavioral1/memory/1968-68-0x0000000000400000-0x000000000044A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
83514393db26424b554847acb66e57c2.exedescription ioc process File created C:\Windows\Tasks\corolina17.job 83514393db26424b554847acb66e57c2.exe File opened for modification C:\Windows\Tasks\corolina17.job 83514393db26424b554847acb66e57c2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
83514393db26424b554847acb66e57c2.exepid process 2044 83514393db26424b554847acb66e57c2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exedescription pid process target process PID 1432 wrote to memory of 1632 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1632 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1632 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1632 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1968 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1968 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1968 1432 taskeng.exe kdwsvi.exe PID 1432 wrote to memory of 1968 1432 taskeng.exe kdwsvi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83514393db26424b554847acb66e57c2.exe"C:\Users\Admin\AppData\Local\Temp\83514393db26424b554847acb66e57c2.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {9685EBEC-032D-470F-826A-56C7AA1F31AB} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bvqsw\kdwsvi.exeC:\ProgramData\bvqsw\kdwsvi.exe start22⤵
- Executes dropped EXE
-
C:\ProgramData\bvqsw\kdwsvi.exeC:\ProgramData\bvqsw\kdwsvi.exe start22⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\bvqsw\kdwsvi.exeFilesize
109KB
MD583514393db26424b554847acb66e57c2
SHA1f011dac01e0e0552c2f42665e444cab907394353
SHA256609107e7e71a4899fa5496da826c92a2ca05134e7f79b0bbda280696de45f937
SHA5125899f1f574e8ae7f607267ada11b193ec5662a437d4db30aa2804f682779fa493369109aea27c57d6a8f190cd74ace17507df9ec06cabb235cb5b8453448de59
-
C:\ProgramData\bvqsw\kdwsvi.exeFilesize
109KB
MD583514393db26424b554847acb66e57c2
SHA1f011dac01e0e0552c2f42665e444cab907394353
SHA256609107e7e71a4899fa5496da826c92a2ca05134e7f79b0bbda280696de45f937
SHA5125899f1f574e8ae7f607267ada11b193ec5662a437d4db30aa2804f682779fa493369109aea27c57d6a8f190cd74ace17507df9ec06cabb235cb5b8453448de59
-
C:\ProgramData\bvqsw\kdwsvi.exeFilesize
109KB
MD583514393db26424b554847acb66e57c2
SHA1f011dac01e0e0552c2f42665e444cab907394353
SHA256609107e7e71a4899fa5496da826c92a2ca05134e7f79b0bbda280696de45f937
SHA5125899f1f574e8ae7f607267ada11b193ec5662a437d4db30aa2804f682779fa493369109aea27c57d6a8f190cd74ace17507df9ec06cabb235cb5b8453448de59
-
memory/1632-61-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1632-58-0x0000000000000000-mapping.dmp
-
memory/1632-62-0x000000000051E000-0x0000000000522000-memory.dmpFilesize
16KB
-
memory/1632-63-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1968-65-0x0000000000000000-mapping.dmp
-
memory/1968-68-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1968-69-0x000000000063E000-0x0000000000642000-memory.dmpFilesize
16KB
-
memory/1968-70-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2044-56-0x000000000056E000-0x0000000000572000-memory.dmpFilesize
16KB
-
memory/2044-54-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/2044-64-0x000000000056E000-0x0000000000572000-memory.dmpFilesize
16KB
-
memory/2044-55-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB