Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 09:47
Static task
static1
Behavioral task
behavioral1
Sample
b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe
Resource
win10-en-20211208
General
-
Target
b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe
-
Size
270KB
-
MD5
303b3d03908034295d2ede5b6ea07f57
-
SHA1
1fa657bc725e38ba78092c2cfb315b2c6266b5af
-
SHA256
b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8
-
SHA512
8f629b62b5df4ec4b342aef4a7e4b18856c757fd00b9f4937fa5d9ae0ecea56c654fdc7af177b46429a2a1a3801e53ff6e9b16a7bddaaaea1f5af3be83d9a3e0
Malware Config
Extracted
tofsee
patmushta.info
ovicrush.cn
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
cxteyooq.exepid process 3352 cxteyooq.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3084 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cxteyooq.exedescription pid process target process PID 3352 set thread context of 3084 3352 cxteyooq.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.execxteyooq.exedescription pid process target process PID 2444 wrote to memory of 2760 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 2760 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 2760 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 3780 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 3780 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 3780 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe cmd.exe PID 2444 wrote to memory of 3712 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 3712 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 3712 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 3320 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 3320 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 3320 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 2012 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 2012 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 2012 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe sc.exe PID 2444 wrote to memory of 580 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe netsh.exe PID 2444 wrote to memory of 580 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe netsh.exe PID 2444 wrote to memory of 580 2444 b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe netsh.exe PID 3352 wrote to memory of 3084 3352 cxteyooq.exe svchost.exe PID 3352 wrote to memory of 3084 3352 cxteyooq.exe svchost.exe PID 3352 wrote to memory of 3084 3352 cxteyooq.exe svchost.exe PID 3352 wrote to memory of 3084 3352 cxteyooq.exe svchost.exe PID 3352 wrote to memory of 3084 3352 cxteyooq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe"C:\Users\Admin\AppData\Local\Temp\b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nocazmoe\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cxteyooq.exe" C:\Windows\SysWOW64\nocazmoe\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nocazmoe binPath= "C:\Windows\SysWOW64\nocazmoe\cxteyooq.exe /d\"C:\Users\Admin\AppData\Local\Temp\b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nocazmoe "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nocazmoe2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\nocazmoe\cxteyooq.exeC:\Windows\SysWOW64\nocazmoe\cxteyooq.exe /d"C:\Users\Admin\AppData\Local\Temp\b4870409b801692faf71a13983f411bc6d39d0503177b105f888c6d0097a3ab8.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cxteyooq.exeMD5
afcc865fbdb9bd9b16c1c68d77a3d2c0
SHA14365c1ebb67556446da24fa3e20f76b667c8a3e4
SHA2565422f5b0f36cbe22be997cb0de50a6f7603db1246c007578e579ad89da67071a
SHA512b0f26b843c55ab839c2689f146c958ca6a0741ef8c5cc1d27c2427f081486e875bbcbfb0d14282cc15051771fc0bb22a3d545f20ab1851f8272faec7c87b2015
-
C:\Windows\SysWOW64\nocazmoe\cxteyooq.exeMD5
afcc865fbdb9bd9b16c1c68d77a3d2c0
SHA14365c1ebb67556446da24fa3e20f76b667c8a3e4
SHA2565422f5b0f36cbe22be997cb0de50a6f7603db1246c007578e579ad89da67071a
SHA512b0f26b843c55ab839c2689f146c958ca6a0741ef8c5cc1d27c2427f081486e875bbcbfb0d14282cc15051771fc0bb22a3d545f20ab1851f8272faec7c87b2015
-
memory/2444-115-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB
-
memory/2444-116-0x00000000004E0000-0x000000000058E000-memory.dmpFilesize
696KB
-
memory/2444-117-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3084-122-0x00000000005E0000-0x00000000005F5000-memory.dmpFilesize
84KB
-
memory/3084-125-0x00000000005E0000-0x00000000005F5000-memory.dmpFilesize
84KB
-
memory/3352-120-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/3352-121-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB