693e7898b554e11d83b95c844318c1a3efef345aefa1cd01a3f4d5bcfcbbef12

General

Target
85cbd15de07204ffb5455f496a1ccd05.exe
Size 10.4MB
Sample201117-bf6kr9xraa
SHA256 693e7898b554e11d83b95c844318c1a3efef345aefa1cd01a3f4d5bcfcbbef12
MD5 e885703b292b35c036c4a9f09335be48
SHA1 e72a18db38c9335cb365219470719572129a98ce
SHA512 ace33ebc910b47241cf7ecd094351fac898359aba3c5777382d828b7a1479e44c46a86e897c49f48ace9dbf8ddb9cce63089fe92b0eae0ffce6f3ae069fb30d3
MD5 SHA1 SHA512

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
3268	rovntkzl.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
3824	svchost.exe

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dkvrggzy\ImagePath = "C:\\Windows\\SysWOW64\\dkvrggzy\\rovntkzl.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 3824	3268	rovntkzl.exe	88

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3680	640	85cbd15de07204ffb5455f496a1ccd05.exe	75
PID 640 wrote to memory of 3680	640	85cbd15de07204ffb5455f496a1ccd05.exe	75
PID 640 wrote to memory of 3680	640	85cbd15de07204ffb5455f496a1ccd05.exe	75
PID 640 wrote to memory of 508	640	85cbd15de07204ffb5455f496a1ccd05.exe	77
PID 640 wrote to memory of 508	640	85cbd15de07204ffb5455f496a1ccd05.exe	77
PID 640 wrote to memory of 508	640	85cbd15de07204ffb5455f496a1ccd05.exe	77
PID 640 wrote to memory of 192	640	85cbd15de07204ffb5455f496a1ccd05.exe	79
PID 640 wrote to memory of 192	640	85cbd15de07204ffb5455f496a1ccd05.exe	79
PID 640 wrote to memory of 192	640	85cbd15de07204ffb5455f496a1ccd05.exe	79
PID 640 wrote to memory of 2172	640	85cbd15de07204ffb5455f496a1ccd05.exe	81
PID 640 wrote to memory of 2172	640	85cbd15de07204ffb5455f496a1ccd05.exe	81
PID 640 wrote to memory of 2172	640	85cbd15de07204ffb5455f496a1ccd05.exe	81
PID 640 wrote to memory of 1528	640	85cbd15de07204ffb5455f496a1ccd05.exe	83
PID 640 wrote to memory of 1528	640	85cbd15de07204ffb5455f496a1ccd05.exe	83
PID 640 wrote to memory of 1528	640	85cbd15de07204ffb5455f496a1ccd05.exe	83
PID 640 wrote to memory of 3740	640	85cbd15de07204ffb5455f496a1ccd05.exe	85
PID 640 wrote to memory of 3740	640	85cbd15de07204ffb5455f496a1ccd05.exe	85
PID 640 wrote to memory of 3740	640	85cbd15de07204ffb5455f496a1ccd05.exe	85
PID 3268 wrote to memory of 3824	3268	rovntkzl.exe	88
PID 3268 wrote to memory of 3824	3268	rovntkzl.exe	88
PID 3268 wrote to memory of 3824	3268	rovntkzl.exe	88
PID 3268 wrote to memory of 3824	3268	rovntkzl.exe	88
PID 3268 wrote to memory of 3824	3268	rovntkzl.exe	88

C:\Users\Admin\AppData\Local\Temp\85cbd15de07204ffb5455f496a1ccd05.exe
"C:\Users\Admin\AppData\Local\Temp\85cbd15de07204ffb5455f496a1ccd05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkvrggzy\
  2⤵
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rovntkzl.exe" C:\Windows\SysWOW64\dkvrggzy\
  2⤵
  PID:508
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dkvrggzy binPath= "C:\Windows\SysWOW64\dkvrggzy\rovntkzl.exe /d\"C:\Users\Admin\AppData\Local\Temp\85cbd15de07204ffb5455f496a1ccd05.exe\"" type= own start= auto DisplayName= "P2P Support"
  2⤵
  PID:192
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dkvrggzy "Internet Mobile Support"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dkvrggzy
  2⤵
  PID:1528
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3740

C:\Windows\SysWOW64\dkvrggzy\rovntkzl.exe
C:\Windows\SysWOW64\dkvrggzy\rovntkzl.exe /d"C:\Users\Admin\AppData\Local\Temp\85cbd15de07204ffb5455f496a1ccd05.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  - Modifies service
  PID:3824