Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 11:38
Static task
static1
Behavioral task
behavioral1
Sample
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe
Resource
win10v2004-20220721-en
General
-
Target
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe
-
Size
98KB
-
MD5
514b7bcdfaee001949a7d283d30b4e4f
-
SHA1
efafadcadb7c5666bc6716b3e3b7228008f78e2e
-
SHA256
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993
-
SHA512
700f7cdc8538f879ecae07218850750bcb0edcf2fddafedbf175119d4c2e0d85efc257f9dfba99a31b0d87cf0b6d2bc915f6931243572c91646df1b70409eb45
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
mholkhde.exepid process 1748 mholkhde.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rgurkdvi\ImagePath = "C:\\Windows\\SysWOW64\\rgurkdvi\\mholkhde.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mholkhde.exedescription pid process target process PID 1748 set thread context of 3048 1748 mholkhde.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 216 sc.exe 3232 sc.exe 688 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exemholkhde.exedescription pid process target process PID 3472 wrote to memory of 2844 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 2844 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 2844 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 3112 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 3112 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 3112 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe cmd.exe PID 3472 wrote to memory of 688 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 688 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 688 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 216 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 216 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 216 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 3232 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 3232 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 3232 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe sc.exe PID 3472 wrote to memory of 3364 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe netsh.exe PID 3472 wrote to memory of 3364 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe netsh.exe PID 3472 wrote to memory of 3364 3472 a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe netsh.exe PID 1748 wrote to memory of 3048 1748 mholkhde.exe svchost.exe PID 1748 wrote to memory of 3048 1748 mholkhde.exe svchost.exe PID 1748 wrote to memory of 3048 1748 mholkhde.exe svchost.exe PID 1748 wrote to memory of 3048 1748 mholkhde.exe svchost.exe PID 1748 wrote to memory of 3048 1748 mholkhde.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe"C:\Users\Admin\AppData\Local\Temp\a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rgurkdvi\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mholkhde.exe" C:\Windows\SysWOW64\rgurkdvi\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create rgurkdvi binPath= "C:\Windows\SysWOW64\rgurkdvi\mholkhde.exe /d\"C:\Users\Admin\AppData\Local\Temp\a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description rgurkdvi "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start rgurkdvi2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\rgurkdvi\mholkhde.exeC:\Windows\SysWOW64\rgurkdvi\mholkhde.exe /d"C:\Users\Admin\AppData\Local\Temp\a2088c326ff419b13f3b65fa4358ac0dae9989f28fc03122f603ec4e1d04a993.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mholkhde.exeFilesize
13.9MB
MD5ab7aeea344af5f9db9a2b73a04edec27
SHA1447e0e25c237c36ecb08369c1e266ea2e625ac16
SHA25634afea54574bec0ecf8c674b49de76909f1853633fe1201955388dc3cd11361e
SHA51283322eeead96b30ec3e24a4e47be2bc761944cbdb782be8485bdde9dff429e2283b8492da519dd9c819e7160ce1d3446984eb65cae9eaeec1622ecd49d31694d
-
C:\Windows\SysWOW64\rgurkdvi\mholkhde.exeFilesize
13.9MB
MD5ab7aeea344af5f9db9a2b73a04edec27
SHA1447e0e25c237c36ecb08369c1e266ea2e625ac16
SHA25634afea54574bec0ecf8c674b49de76909f1853633fe1201955388dc3cd11361e
SHA51283322eeead96b30ec3e24a4e47be2bc761944cbdb782be8485bdde9dff429e2283b8492da519dd9c819e7160ce1d3446984eb65cae9eaeec1622ecd49d31694d
-
memory/216-135-0x0000000000000000-mapping.dmp
-
memory/688-134-0x0000000000000000-mapping.dmp
-
memory/1748-139-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2844-131-0x0000000000000000-mapping.dmp
-
memory/3048-140-0x0000000000000000-mapping.dmp
-
memory/3048-141-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/3048-143-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/3048-144-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/3048-145-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/3112-132-0x0000000000000000-mapping.dmp
-
memory/3232-136-0x0000000000000000-mapping.dmp
-
memory/3364-137-0x0000000000000000-mapping.dmp
-
memory/3472-130-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB