Analysis
-
max time kernel
162s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 10:18
Static task
static1
Behavioral task
behavioral1
Sample
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe
Resource
win10v2004-en-20220112
General
-
Target
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe
-
Size
84KB
-
MD5
e1e6cc20c8ac3d45b335605cb3ebad92
-
SHA1
60ceafc423200bb22495998aaada0df0b43b3d11
-
SHA256
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112
-
SHA512
0837073758f5453d564fceb91daa70a28381ced357a8d041480b7f44ae9dfc4ff4c161643ac259ef4d69ee967e1a9d340c9d1ec2d76afedbb3e267f788403f18
Malware Config
Extracted
systembc
31.44.184.201:4081
31.44.184.202:4081
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
txineim.exepid process 3428 txineim.exe -
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 2 IoCs
Processes:
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exedescription ioc process File created C:\Windows\Tasks\txineim.job 5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe File opened for modification C:\Windows\Tasks\txineim.job 5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exepid process 408 5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe 408 5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe"C:\Users\Admin\AppData\Local\Temp\5eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:408
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe eda6178cf020037f3cf464e9c17f170d zI7tg6i4XkS7qX4zTH8XcA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:1276
-
C:\ProgramData\ixel\txineim.exeC:\ProgramData\ixel\txineim.exe start21⤵
- Executes dropped EXE
PID:3428
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ixel\txineim.exeMD5
e1e6cc20c8ac3d45b335605cb3ebad92
SHA160ceafc423200bb22495998aaada0df0b43b3d11
SHA2565eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112
SHA5120837073758f5453d564fceb91daa70a28381ced357a8d041480b7f44ae9dfc4ff4c161643ac259ef4d69ee967e1a9d340c9d1ec2d76afedbb3e267f788403f18
-
C:\ProgramData\ixel\txineim.exeMD5
e1e6cc20c8ac3d45b335605cb3ebad92
SHA160ceafc423200bb22495998aaada0df0b43b3d11
SHA2565eaf5d22f937189275b6fae1257fc682194ca768a91d7b5e897770ad008f7112
SHA5120837073758f5453d564fceb91daa70a28381ced357a8d041480b7f44ae9dfc4ff4c161643ac259ef4d69ee967e1a9d340c9d1ec2d76afedbb3e267f788403f18
-
memory/408-130-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/408-131-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB