Analysis
-
max time kernel
156s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 15:55
Static task
static1
Behavioral task
behavioral1
Sample
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe
Resource
win10v2004-20220812-en
General
-
Target
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe
-
Size
772KB
-
MD5
95f60b5b36d63307d83e3f3de9675a1d
-
SHA1
da733991d9618b3a3bb5cc503ba0e860f1e8ea29
-
SHA256
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674
-
SHA512
de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff
-
SSDEEP
12288:6sFxcCZxPEWJNy93q0DWm9+X6MSUJKzR9wz2U7qdyys2he3gxNMlKglt8RsrtUvy:bHP7gqXpKGNehe3x3r8CU
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xlobkpb.exexlobkpb.exepid process 504 xlobkpb.exe 3720 xlobkpb.exe -
Drops file in System32 directory 1 IoCs
Processes:
xlobkpb.exedescription ioc process File created C:\Windows\SysWOW64\x\system.pif xlobkpb.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exexlobkpb.exedescription pid process target process PID 3788 set thread context of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 504 set thread context of 3720 504 xlobkpb.exe xlobkpb.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exef9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exexlobkpb.exexlobkpb.exepid process 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe 2156 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe 2156 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe 504 xlobkpb.exe 504 xlobkpb.exe 3720 xlobkpb.exe 3720 xlobkpb.exe 3720 xlobkpb.exe 3720 xlobkpb.exe 3720 xlobkpb.exe 3720 xlobkpb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
xlobkpb.exedescription pid process Token: SeDebugPrivilege 3720 xlobkpb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exexlobkpb.exepid process 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe 504 xlobkpb.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exexlobkpb.exexlobkpb.exesvchost.exedescription pid process target process PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 3788 wrote to memory of 2156 3788 f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 504 wrote to memory of 3720 504 xlobkpb.exe xlobkpb.exe PID 3720 wrote to memory of 752 3720 xlobkpb.exe svchost.exe PID 752 wrote to memory of 884 752 svchost.exe mousocoreworker.exe PID 752 wrote to memory of 884 752 svchost.exe mousocoreworker.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵
-
C:\Users\Admin\AppData\Local\Temp\f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe"C:\Users\Admin\AppData\Local\Temp\f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exeC:\Users\Admin\AppData\Local\Temp\f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeC:\Users\Admin\AppData\Local\Temp\xlobkpb.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeC:\Users\Admin\AppData\Local\Temp\xlobkpb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SoftwareDistribution\xkefqneFilesize
654B
MD532c22df645efd3290d98f770a4f6f381
SHA168c8a185a08a693431a29b817ce0ebf5744b7376
SHA256d7082b7c7a4c8fac58b286d89291e981e111f8498d416ec06495b5513c83a0e1
SHA5126c8db1c39e4ea714e28ac6dddff80d9451333eea28b5f302a2d1865c025690ebb34c9bf98eddcf3e0bf3e3c73da446206ac8a384e787fa1d33d9a889fa52b0c1
-
C:\ProgramData\SoftwareDistribution\xkefqneFilesize
654B
MD532c22df645efd3290d98f770a4f6f381
SHA168c8a185a08a693431a29b817ce0ebf5744b7376
SHA256d7082b7c7a4c8fac58b286d89291e981e111f8498d416ec06495b5513c83a0e1
SHA5126c8db1c39e4ea714e28ac6dddff80d9451333eea28b5f302a2d1865c025690ebb34c9bf98eddcf3e0bf3e3c73da446206ac8a384e787fa1d33d9a889fa52b0c1
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
772KB
MD595f60b5b36d63307d83e3f3de9675a1d
SHA1da733991d9618b3a3bb5cc503ba0e860f1e8ea29
SHA256f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674
SHA512de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
772KB
MD595f60b5b36d63307d83e3f3de9675a1d
SHA1da733991d9618b3a3bb5cc503ba0e860f1e8ea29
SHA256f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674
SHA512de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
772KB
MD595f60b5b36d63307d83e3f3de9675a1d
SHA1da733991d9618b3a3bb5cc503ba0e860f1e8ea29
SHA256f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674
SHA512de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff
-
memory/752-147-0x0000000039840000-0x00000000398B7000-memory.dmpFilesize
476KB
-
memory/884-150-0x0000000000000000-mapping.dmp
-
memory/2156-138-0x0000000000400000-0x00000000004A4600-memory.dmpFilesize
657KB
-
memory/2156-137-0x0000000028CF0000-0x0000000028F3B000-memory.dmpFilesize
2.3MB
-
memory/2156-136-0x0000000028AD0000-0x0000000028CEA000-memory.dmpFilesize
2.1MB
-
memory/2156-134-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2156-133-0x0000000000000000-mapping.dmp
-
memory/3720-141-0x0000000000000000-mapping.dmp
-
memory/3720-146-0x0000000028C70000-0x0000000028EBB000-memory.dmpFilesize
2.3MB
-
memory/3788-132-0x0000000000710000-0x0000000000714000-memory.dmpFilesize
16KB