Managed XDR

c-users-public-conlhost.exe (BlackMatter, Lockbit, 7ev3n) — malware analysis report

File info

Filename
c-users-public-conlhost.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
9 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
f796fb95ae1278a764490728f541d4d08479b834
SHA256
fe007df0a7a38e1903289e5ed9457ea87d2723c9d84f2a0c994987ee0f9e5a6d
MD5
bc91459dd0534e9942200f63e72195af

Malwares

  • BlackMatter
  • Lockbit
  • 7ev3n

Signatures

Execution

T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1564.001 stealth_file: Creates hidden or system files
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552.001 infostealer_bitcoin: Attempts to obtain access to Bitcoin/ALTCoin wallets
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1083 crawls_directories: Opens a huge number of directories all over disk C: (possibly, searches for sensitive data)
T1057 has_wmi: Executes one or several WMI requests
T1082 has_wmi: Executes one or several WMI requests
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl

Impact

T1486 modifies_files2: Cryptolocker indicators detected (100 or more files are modified)
T1486 modifies_files: Cryptolocker indicators detected (renamed 50 or more files)
T1486 ransomware_files_2: Ransomware(s) 7ev3n indicators detected (creates keys and the instruction on how to unlock the files)
T1486 ransomware_message: Ransomware indicators detected (possible ransom message creation)

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
ip_domains: Identifies an IP address using external resources
network_bind: Starts servers listening at None
creates_doc: Creates (office) documents in the file system
dead_host: Connects to IP addresses that do not respond to requests
suspicious_memory_strings: Suspicious strings have been found in process memory
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
pe_overlay: PE file contains overlay

Related reports

Managed XDR