Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe
Resource
win10v2004-20240508-en
General
-
Target
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe
-
Size
407KB
-
MD5
ffba07a5701366399cfafa6e489dee91
-
SHA1
4905817f27d651cfef4021426e476b37f6a25a0d
-
SHA256
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa
-
SHA512
b71ba8015cd7b65148f7ddf16f8015b70a045e50931c9b00bc41b89f7cff141854fde5deb8ca39708629b440365dd21acfd8058b27695c44a2e7f1f8d642077d
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 3 2496 rundll32.exe 7 2496 rundll32.exe 8 2496 rundll32.exe 9 2496 rundll32.exe 10 2496 rundll32.exe 13 2496 rundll32.exe 14 2496 rundll32.exe 15 2496 rundll32.exe 17 2496 rundll32.exe 18 2496 rundll32.exe -
Deletes itself 1 IoCs
Processes:
fqesq.exepid process 2648 fqesq.exe -
Executes dropped EXE 1 IoCs
Processes:
fqesq.exepid process 2648 fqesq.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exerundll32.exepid process 2688 cmd.exe 2688 cmd.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\dsnwf\\upgov.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\y: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 2496 rundll32.exe -
Drops file in Program Files directory 2 IoCs
Processes:
fqesq.exedescription ioc process File opened for modification \??\c:\Program Files\dsnwf fqesq.exe File created \??\c:\Program Files\dsnwf\upgov.dll fqesq.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 2496 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exefqesq.exepid process 2156 fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe 2648 fqesq.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.execmd.exefqesq.exedescription pid process target process PID 2156 wrote to memory of 2688 2156 fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe cmd.exe PID 2156 wrote to memory of 2688 2156 fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe cmd.exe PID 2156 wrote to memory of 2688 2156 fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe cmd.exe PID 2156 wrote to memory of 2688 2156 fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe cmd.exe PID 2688 wrote to memory of 2956 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2956 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2956 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2956 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2648 2688 cmd.exe fqesq.exe PID 2688 wrote to memory of 2648 2688 cmd.exe fqesq.exe PID 2688 wrote to memory of 2648 2688 cmd.exe fqesq.exe PID 2688 wrote to memory of 2648 2688 cmd.exe fqesq.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe PID 2648 wrote to memory of 2496 2648 fqesq.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe"C:\Users\Admin\AppData\Local\Temp\fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\fqesq.exe "C:\Users\Admin\AppData\Local\Temp\fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\fqesq.exeC:\Users\Admin\AppData\Local\Temp\\fqesq.exe "C:\Users\Admin\AppData\Local\Temp\fc60f1ead466b76c91aadd1f78c4fcb2c1b4dfc99ac9b93e45a5efdd62ce7caa.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\dsnwf\upgov.dll",Verify C:\Users\Admin\AppData\Local\Temp\fqesq.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD52ebfd94526353117741976fa41b2eb9c
SHA1508a1a69e1f8d2e76a520ba487b6ec62abf0a0c6
SHA256825f12192fabc68e76900605a304da44417a08dff82a8f9b02a9ccead56a1521
SHA5124cdcc3fa153c8cb8f1e64cd75e25bd593ceb30af84d5dc919dc5f8217ec556e9b346e3d14fab5e6029657bede36f9440c073240803b75997c8c5b2db45cea256
-
Filesize
407KB
MD5394e0d95883086120268a880eedac5c0
SHA19f388baa601aaa35fee7eea68fe6d8388b386076
SHA256b252ffcfff610fc419b4b8b0b9b88376f0f0d69c89947100b8af858bdc858cc0
SHA51297c7a719941faf2a1bc1e8facbc99bd7333da987c9f7eb15105c032efcd39a681b7bd988f37f8f384231dbf33c34b949a198b80c18c687aacd12ea0d17a3e782