Analysis
-
max time kernel
144s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2023 04:32
Static task
static1
Behavioral task
behavioral1
Sample
fire.exe
Resource
win7-20230220-en
General
-
Target
fire.exe
-
Size
3.8MB
-
MD5
86000b0a976dc4a377b2e5192fe30445
-
SHA1
ad29b138883d7906f8d6e75f2e5f60e5285d4a56
-
SHA256
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
-
SHA512
4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
SSDEEP
98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
wbnh.exewbnh.exewbnh.exewbnh.exewbnh.exewbnh.exepid process 5060 wbnh.exe 972 wbnh.exe 4072 wbnh.exe 4496 wbnh.exe 4040 wbnh.exe 5068 wbnh.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
wbnh.exewbnh.exewbnh.exepid process 972 wbnh.exe 972 wbnh.exe 972 wbnh.exe 972 wbnh.exe 4496 wbnh.exe 5068 wbnh.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
fire.exewbnh.exewbnh.exewbnh.exedescription pid process target process PID 3244 set thread context of 4480 3244 fire.exe fire.exe PID 5060 set thread context of 972 5060 wbnh.exe wbnh.exe PID 4072 set thread context of 4496 4072 wbnh.exe wbnh.exe PID 4040 set thread context of 5068 4040 wbnh.exe wbnh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4956 4480 WerFault.exe fire.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5096 schtasks.exe 3760 schtasks.exe 3756 schtasks.exe 8 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wbnh.exewbnh.exewbnh.exedescription pid process Token: SeShutdownPrivilege 972 wbnh.exe Token: SeShutdownPrivilege 4496 wbnh.exe Token: SeShutdownPrivilege 5068 wbnh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
wbnh.exepid process 972 wbnh.exe 972 wbnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fire.execmd.exewbnh.execmd.exewbnh.exedescription pid process target process PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 4480 3244 fire.exe fire.exe PID 3244 wrote to memory of 2676 3244 fire.exe cmd.exe PID 3244 wrote to memory of 2676 3244 fire.exe cmd.exe PID 3244 wrote to memory of 2676 3244 fire.exe cmd.exe PID 3244 wrote to memory of 3864 3244 fire.exe cmd.exe PID 3244 wrote to memory of 3864 3244 fire.exe cmd.exe PID 3244 wrote to memory of 3864 3244 fire.exe cmd.exe PID 3244 wrote to memory of 2648 3244 fire.exe cmd.exe PID 3244 wrote to memory of 2648 3244 fire.exe cmd.exe PID 3244 wrote to memory of 2648 3244 fire.exe cmd.exe PID 3864 wrote to memory of 3756 3864 cmd.exe schtasks.exe PID 3864 wrote to memory of 3756 3864 cmd.exe schtasks.exe PID 3864 wrote to memory of 3756 3864 cmd.exe schtasks.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 972 5060 wbnh.exe wbnh.exe PID 5060 wrote to memory of 1300 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 1300 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 1300 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 3528 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 3528 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 3528 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 4420 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 4420 5060 wbnh.exe cmd.exe PID 5060 wrote to memory of 4420 5060 wbnh.exe cmd.exe PID 3528 wrote to memory of 8 3528 cmd.exe schtasks.exe PID 3528 wrote to memory of 8 3528 cmd.exe schtasks.exe PID 3528 wrote to memory of 8 3528 cmd.exe schtasks.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4496 4072 wbnh.exe wbnh.exe PID 4072 wrote to memory of 4980 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 4980 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 4980 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 848 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 848 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 848 4072 wbnh.exe cmd.exe PID 4072 wrote to memory of 3084 4072 wbnh.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fire.exe"C:\Users\Admin\AppData\Local\Temp\fire.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fire.exe"C:\Users\Admin\AppData\Local\Temp\fire.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\fire.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 44801⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wbnh.exe.logFilesize
612B
MD54bc94363628f46b343c5e8e2da62ca26
SHA18a41ac46e24d790e11a407d0e957c4a6be6056c4
SHA256c8e1d0b306825b2c9a3ed32a461dd191ceb861205425fdfb687a4889684a3e1a
SHA512cf8ede5b84ba775d8ff89752530fa899d6b2e6424549202ab782a3caa92c0d9a31e9b2f660b51eedc932a68ba25e9ec228bb965cdc183e600ea8aa5a6736f829
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
memory/972-171-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-187-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-190-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-155-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-157-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-158-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-160-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-161-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-165-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-166-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-167-0x0000000074700000-0x0000000074739000-memory.dmpFilesize
228KB
-
memory/972-168-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-169-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-170-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-189-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-172-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-188-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-186-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-185-0x0000000074700000-0x0000000074739000-memory.dmpFilesize
228KB
-
memory/972-184-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/972-183-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/972-182-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3244-133-0x0000000000200000-0x00000000005D6000-memory.dmpFilesize
3.8MB
-
memory/3244-135-0x0000000004F50000-0x0000000004FB6000-memory.dmpFilesize
408KB
-
memory/3244-134-0x0000000005430000-0x00000000059D4000-memory.dmpFilesize
5.6MB
-
memory/3244-136-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/4480-138-0x0000000000F40000-0x000000000130E000-memory.dmpFilesize
3.8MB
-
memory/4480-147-0x0000000000F40000-0x000000000130E000-memory.dmpFilesize
3.8MB
-
memory/4480-143-0x0000000000F40000-0x000000000130E000-memory.dmpFilesize
3.8MB
-
memory/4496-179-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4496-178-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4496-177-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4496-181-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/5060-153-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/5068-194-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/5068-195-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/5068-196-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/5068-198-0x0000000074AA0000-0x0000000074AD9000-memory.dmpFilesize
228KB
-
memory/5068-199-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB