Analysis
-
max time kernel
1800s -
max time network
1797s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-06-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe
Resource
win10v2004-20220414-en
General
-
Target
c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe
-
Size
13.7MB
-
MD5
5408cff5586901cfb35b5ed13505c161
-
SHA1
e929d7dc906bdc0eb20c4009b085443bc7af996f
-
SHA256
c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16
-
SHA512
f1f6bde7b47b13da6ede09ae7e25e1ac5444880cea3ed2bbad2a806ae7e80393998670febb7bbc0bd0221a3a9ce741b2a39ad7199ad561061e0545ae0966558c
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\fboteabs = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ydnicoln.exepid process 336 ydnicoln.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fboteabs\ImagePath = "C:\\Windows\\SysWOW64\\fboteabs\\ydnicoln.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1084 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ydnicoln.exedescription pid process target process PID 336 set thread context of 1084 336 ydnicoln.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2032 sc.exe 1408 sc.exe 1808 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exeydnicoln.exedescription pid process target process PID 1376 wrote to memory of 1932 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1932 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1932 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1932 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1720 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1720 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1720 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 1720 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe cmd.exe PID 1376 wrote to memory of 2032 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 2032 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 2032 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 2032 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1408 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1408 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1408 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1408 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1808 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1808 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1808 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 1808 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe sc.exe PID 1376 wrote to memory of 672 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe netsh.exe PID 1376 wrote to memory of 672 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe netsh.exe PID 1376 wrote to memory of 672 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe netsh.exe PID 1376 wrote to memory of 672 1376 c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe netsh.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe PID 336 wrote to memory of 1084 336 ydnicoln.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe"C:\Users\Admin\AppData\Local\Temp\c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fboteabs\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ydnicoln.exe" C:\Windows\SysWOW64\fboteabs\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fboteabs binPath= "C:\Windows\SysWOW64\fboteabs\ydnicoln.exe /d\"C:\Users\Admin\AppData\Local\Temp\c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fboteabs "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fboteabs2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\fboteabs\ydnicoln.exeC:\Windows\SysWOW64\fboteabs\ydnicoln.exe /d"C:\Users\Admin\AppData\Local\Temp\c5af074d1dc7563538561414790ce838b29a04f80c877a0d3e235b83a2130d16.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ydnicoln.exeFilesize
10.1MB
MD55499e38f55c2ed605762d0aff1bd38c9
SHA16d4109d1959d18555ecdee7b4af03450d2183efc
SHA256441e4f2f0690aeb60caeef2c9c9cd9ec68de54ebdffe8bc84dda02736da929c8
SHA512b9b0789031173e403d29846798deb3c122b841345de57b7e98d20f836facb1d077d69040f4556b51948d6937cea89c76f44d9aef3a47082a3c536a361d22c8f4
-
C:\Windows\SysWOW64\fboteabs\ydnicoln.exeFilesize
10.1MB
MD55499e38f55c2ed605762d0aff1bd38c9
SHA16d4109d1959d18555ecdee7b4af03450d2183efc
SHA256441e4f2f0690aeb60caeef2c9c9cd9ec68de54ebdffe8bc84dda02736da929c8
SHA512b9b0789031173e403d29846798deb3c122b841345de57b7e98d20f836facb1d077d69040f4556b51948d6937cea89c76f44d9aef3a47082a3c536a361d22c8f4
-
memory/336-74-0x0000000000D2B000-0x0000000000D39000-memory.dmpFilesize
56KB
-
memory/336-77-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/672-65-0x0000000000000000-mapping.dmp
-
memory/1084-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1084-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1084-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1084-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1084-73-0x0000000000089A6B-mapping.dmp
-
memory/1376-54-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/1376-66-0x0000000000CFB000-0x0000000000D09000-memory.dmpFilesize
56KB
-
memory/1376-67-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/1376-57-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1376-58-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/1376-56-0x0000000000CFB000-0x0000000000D09000-memory.dmpFilesize
56KB
-
memory/1408-62-0x0000000000000000-mapping.dmp
-
memory/1720-59-0x0000000000000000-mapping.dmp
-
memory/1808-63-0x0000000000000000-mapping.dmp
-
memory/1932-55-0x0000000000000000-mapping.dmp
-
memory/2032-61-0x0000000000000000-mapping.dmp