Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2023 21:18
Static task
static1
Behavioral task
behavioral1
Sample
fire.exe
Resource
win7-20230220-en
General
-
Target
fire.exe
-
Size
3.8MB
-
MD5
86000b0a976dc4a377b2e5192fe30445
-
SHA1
ad29b138883d7906f8d6e75f2e5f60e5285d4a56
-
SHA256
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
-
SHA512
4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
SSDEEP
98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
wbnh.exewbnh.exewbnh.exewbnh.exewbnh.exewbnh.exepid process 2028 wbnh.exe 832 wbnh.exe 1744 wbnh.exe 1584 wbnh.exe 1280 wbnh.exe 940 wbnh.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
fire.exewbnh.exepid process 928 fire.exe 928 fire.exe 928 fire.exe 928 fire.exe 928 fire.exe 1584 wbnh.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
fire.exewbnh.exewbnh.exewbnh.exedescription pid process target process PID 592 set thread context of 928 592 fire.exe fire.exe PID 2028 set thread context of 832 2028 wbnh.exe wbnh.exe PID 1744 set thread context of 1584 1744 wbnh.exe wbnh.exe PID 1280 set thread context of 940 1280 wbnh.exe wbnh.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1680 schtasks.exe 1812 schtasks.exe 904 schtasks.exe 1556 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
fire.exedescription ioc process File created C:\Users\Admin\AppData\Local:31-03-2023 fire.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
fire.exewbnh.exedescription pid process Token: SeDebugPrivilege 928 fire.exe Token: SeShutdownPrivilege 928 fire.exe Token: SeDebugPrivilege 1584 wbnh.exe Token: SeShutdownPrivilege 1584 wbnh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fire.exepid process 928 fire.exe 928 fire.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fire.execmd.exetaskeng.exewbnh.execmd.exedescription pid process target process PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 928 592 fire.exe fire.exe PID 592 wrote to memory of 1752 592 fire.exe cmd.exe PID 592 wrote to memory of 1752 592 fire.exe cmd.exe PID 592 wrote to memory of 1752 592 fire.exe cmd.exe PID 592 wrote to memory of 1752 592 fire.exe cmd.exe PID 592 wrote to memory of 1592 592 fire.exe cmd.exe PID 592 wrote to memory of 1592 592 fire.exe cmd.exe PID 592 wrote to memory of 1592 592 fire.exe cmd.exe PID 592 wrote to memory of 1592 592 fire.exe cmd.exe PID 592 wrote to memory of 672 592 fire.exe cmd.exe PID 592 wrote to memory of 672 592 fire.exe cmd.exe PID 592 wrote to memory of 672 592 fire.exe cmd.exe PID 592 wrote to memory of 672 592 fire.exe cmd.exe PID 1592 wrote to memory of 1556 1592 cmd.exe schtasks.exe PID 1592 wrote to memory of 1556 1592 cmd.exe schtasks.exe PID 1592 wrote to memory of 1556 1592 cmd.exe schtasks.exe PID 1592 wrote to memory of 1556 1592 cmd.exe schtasks.exe PID 1636 wrote to memory of 2028 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 2028 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 2028 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 2028 1636 taskeng.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 832 2028 wbnh.exe wbnh.exe PID 2028 wrote to memory of 1520 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1520 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1520 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1520 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 420 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 420 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 420 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 420 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1368 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1368 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1368 2028 wbnh.exe cmd.exe PID 2028 wrote to memory of 1368 2028 wbnh.exe cmd.exe PID 420 wrote to memory of 1680 420 cmd.exe schtasks.exe PID 420 wrote to memory of 1680 420 cmd.exe schtasks.exe PID 420 wrote to memory of 1680 420 cmd.exe schtasks.exe PID 420 wrote to memory of 1680 420 cmd.exe schtasks.exe PID 1636 wrote to memory of 1744 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 1744 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 1744 1636 taskeng.exe wbnh.exe PID 1636 wrote to memory of 1744 1636 taskeng.exe wbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fire.exe"C:\Users\Admin\AppData\Local\Temp\fire.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fire.exe"C:\Users\Admin\AppData\Local\Temp\fire.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\fire.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {9B7EFECF-9AEF-4367-87DA-6120E817B171} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
memory/592-58-0x0000000000500000-0x0000000000540000-memory.dmpFilesize
256KB
-
memory/592-54-0x0000000001100000-0x00000000014D6000-memory.dmpFilesize
3.8MB
-
memory/832-96-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/928-109-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-100-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-72-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-74-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-75-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-76-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-79-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-80-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-81-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/928-82-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/928-83-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-64-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/928-55-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-56-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-62-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-99-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-66-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-101-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-102-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-104-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-103-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-106-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-105-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-107-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-108-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-111-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-113-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-115-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-117-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-118-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-119-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-121-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-123-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-124-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/928-57-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1744-126-0x0000000000340000-0x0000000000716000-memory.dmpFilesize
3.8MB
-
memory/2028-95-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/2028-87-0x0000000000340000-0x0000000000716000-memory.dmpFilesize
3.8MB