Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 19:16
Static task
static1
Behavioral task
behavioral1
Sample
3-psltrtbl.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
3-psltrtbl.exe
Resource
win10v2004-20220721-en
General
-
Target
3-psltrtbl.exe
-
Size
14.9MB
-
MD5
b43621f4b65408c95be2bb609f310f37
-
SHA1
9bb79973daf63550d3f403c10f6be0a57f797b7f
-
SHA256
d5a45f5fbe4d0679d208908a1282e6675456cf565b427d886cab0b2fdf92c21b
-
SHA512
9d09de7115fca7316815c7fcfea2c431bfeccea2629aa3878ea52bd241f1ea8b60bda70828420ced7e0cfd3fbf9bb032a8656d2085afcd748cfbd6ba4e1cb04e
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qoywwmvl.exepid process 952 qoywwmvl.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jblpobsy\ImagePath = "C:\\Windows\\SysWOW64\\jblpobsy\\qoywwmvl.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3-psltrtbl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 3-psltrtbl.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qoywwmvl.exedescription pid process target process PID 952 set thread context of 1884 952 qoywwmvl.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2288 sc.exe 228 sc.exe 3388 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
3-psltrtbl.exeqoywwmvl.exedescription pid process target process PID 2432 wrote to memory of 4748 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 4748 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 4748 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 3788 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 3788 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 3788 2432 3-psltrtbl.exe cmd.exe PID 2432 wrote to memory of 2288 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 2288 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 2288 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 228 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 228 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 228 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 3388 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 3388 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 3388 2432 3-psltrtbl.exe sc.exe PID 2432 wrote to memory of 3996 2432 3-psltrtbl.exe netsh.exe PID 2432 wrote to memory of 3996 2432 3-psltrtbl.exe netsh.exe PID 2432 wrote to memory of 3996 2432 3-psltrtbl.exe netsh.exe PID 952 wrote to memory of 1884 952 qoywwmvl.exe svchost.exe PID 952 wrote to memory of 1884 952 qoywwmvl.exe svchost.exe PID 952 wrote to memory of 1884 952 qoywwmvl.exe svchost.exe PID 952 wrote to memory of 1884 952 qoywwmvl.exe svchost.exe PID 952 wrote to memory of 1884 952 qoywwmvl.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3-psltrtbl.exe"C:\Users\Admin\AppData\Local\Temp\3-psltrtbl.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jblpobsy\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qoywwmvl.exe" C:\Windows\SysWOW64\jblpobsy\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create jblpobsy binPath= "C:\Windows\SysWOW64\jblpobsy\qoywwmvl.exe /d\"C:\Users\Admin\AppData\Local\Temp\3-psltrtbl.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description jblpobsy "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start jblpobsy2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\jblpobsy\qoywwmvl.exeC:\Windows\SysWOW64\jblpobsy\qoywwmvl.exe /d"C:\Users\Admin\AppData\Local\Temp\3-psltrtbl.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qoywwmvl.exeFilesize
14.5MB
MD50468583d458f772031d978b06670f0b9
SHA14718e6b55f3f012307bda11107e8471160cf2f18
SHA256c0546ef8d24a8b3e4b366b437a9bd20b57bbf40649ea1b7cfb8e7538912291be
SHA51287fcb27ac66e07d180ae1ba6d80f2414b95b5e600cbd3ec0057f422ca8a0994a2fd85b7d66500698fad17136264bc2cf783bab72d98b9ed419c6ccbc2509e9b0
-
C:\Windows\SysWOW64\jblpobsy\qoywwmvl.exeFilesize
14.5MB
MD50468583d458f772031d978b06670f0b9
SHA14718e6b55f3f012307bda11107e8471160cf2f18
SHA256c0546ef8d24a8b3e4b366b437a9bd20b57bbf40649ea1b7cfb8e7538912291be
SHA51287fcb27ac66e07d180ae1ba6d80f2414b95b5e600cbd3ec0057f422ca8a0994a2fd85b7d66500698fad17136264bc2cf783bab72d98b9ed419c6ccbc2509e9b0
-
memory/228-137-0x0000000000000000-mapping.dmp
-
memory/952-148-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/952-146-0x0000000000668000-0x0000000000676000-memory.dmpFilesize
56KB
-
memory/1884-145-0x0000000000EE0000-0x0000000000EF5000-memory.dmpFilesize
84KB
-
memory/1884-151-0x0000000000EE0000-0x0000000000EF5000-memory.dmpFilesize
84KB
-
memory/1884-150-0x0000000000EE0000-0x0000000000EF5000-memory.dmpFilesize
84KB
-
memory/1884-144-0x0000000000000000-mapping.dmp
-
memory/2288-136-0x0000000000000000-mapping.dmp
-
memory/2432-142-0x00000000021E0000-0x00000000021F3000-memory.dmpFilesize
76KB
-
memory/2432-141-0x000000000071D000-0x000000000072B000-memory.dmpFilesize
56KB
-
memory/2432-143-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/2432-133-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/2432-130-0x000000000071D000-0x000000000072B000-memory.dmpFilesize
56KB
-
memory/2432-131-0x00000000021E0000-0x00000000021F3000-memory.dmpFilesize
76KB
-
memory/3388-138-0x0000000000000000-mapping.dmp
-
memory/3788-134-0x0000000000000000-mapping.dmp
-
memory/3996-140-0x0000000000000000-mapping.dmp
-
memory/4748-132-0x0000000000000000-mapping.dmp