c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27

Analysis

max time kernel
152s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
Size

77KB
MD5

0729745eb07d035cd046df93edf85067
SHA1

5ec7f5eb8ac2a55b9ad1a708d8b1aeeae234f6a4
SHA256

c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27
SHA512

2023e58dca17351b0d46a71fae5ebb3640b5ab26704f6f14dc6174cd06a129d5f7c9f2579cb4243b337970d9fa45b3b3fbba8293cd1679a436c6b72248d76436
SSDEEP

1536:93pxWkcQpvZTQT8op1kBOlyN5op1PsdIRwDio4g1pBRq:FpxWEWFpK0nLs9gg1w

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DRIvers\lrybaj.SYS	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qleyqi\parameters\SERVICEDLL = "%SystemRoot%\\System32\\lrybaj.dll"	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CONTROLSET002\SERVICES\qleyqi\parameters\SERVICEDLL = "%SystemRoot%\\System32\\lrybaj.dll"	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CONTROLSET003\SERVICES\qleyqi\parameters\SERVICEDLL = "%SystemRoot%\\System32\\lrybaj.dll"	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe

Deletes itself 1 IoCs

pid	Process
1964	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1976	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
1964	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\5300b.log	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
File created	C:\Windows\SysWOW64\lrybaj.dll	c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

C:\Users\Admin\AppData\Local\Temp\c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe
"C:\Users\Admin\AppData\Local\Temp\c7633467119f491b2e519b9d9da0d5c01183e647998f09eef4f898fb92eb9b27.exe"
1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k qleyqi
1⤵
- Deletes itself
- Loads dropped DLL
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\lrybaj.dll

Filesize
103KB

MD5
42e92013b2c35be0e2f8faa1ee3f03d2

SHA1
a9fb42a44e78dcbc4419dccda691fb7ad4dfc760

SHA256
bfb2096b3939190a8bdf2d212a98f3b839d8695d8061634ec85f359a9b431e26

SHA512
27e3d2035248c4c9880c088b32844da40b86217b74d7416d23af35cf3a27f3368a229473fce22f0bac38b981b90269751f1dd4e2467cfea85fed28377da33758

Download Submit
\Windows\SysWOW64\lrybaj.dll

Filesize
103KB

MD5
42e92013b2c35be0e2f8faa1ee3f03d2

SHA1
a9fb42a44e78dcbc4419dccda691fb7ad4dfc760

SHA256
bfb2096b3939190a8bdf2d212a98f3b839d8695d8061634ec85f359a9b431e26

SHA512
27e3d2035248c4c9880c088b32844da40b86217b74d7416d23af35cf3a27f3368a229473fce22f0bac38b981b90269751f1dd4e2467cfea85fed28377da33758

Download Submit
\Windows\SysWOW64\lrybaj.dll

Filesize
103KB

MD5
42e92013b2c35be0e2f8faa1ee3f03d2

SHA1
a9fb42a44e78dcbc4419dccda691fb7ad4dfc760

SHA256
bfb2096b3939190a8bdf2d212a98f3b839d8695d8061634ec85f359a9b431e26

SHA512
27e3d2035248c4c9880c088b32844da40b86217b74d7416d23af35cf3a27f3368a229473fce22f0bac38b981b90269751f1dd4e2467cfea85fed28377da33758

Download Submit
memory/1964-60-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1976-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download