abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af

General

Target

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
Size

145KB
MD5

d9e0b4fc74b9b247145c425d37376cdc
SHA1

95c1049fe15fa8550d7a4cee28e0121c516a7dce
SHA256

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af
SHA512

c8314e989a532cd979d0f1994d274f5420dc69a1370282f07668d21be0c3745c877b45254be83ca4b4983a26f76d72da5228353c2f11ccfb1de9af6ede22b715
SSDEEP

1536:p9SS9CRjbBeA5U668zy9DQRg8fssPh2b/UVJMcv287gv3maoYtH96qD4gu:PoZ8A5U668G9+DPYuvhVYlD4B

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

svcnost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svcnost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	svcnost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	svcnost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\xkwtbyzmmjcxhchhsmtusahkcjbhdoqg2\svcnost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\xkwtbyzmmjcxhchhsmtusahkcjbhdoqg2\\svcnost.exe:*:Enabled:ldrsoft"	svcnost.exe

Drops file in Drivers directory 1 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4964-135-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4964-138-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/984-143-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4964-145-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/984-149-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

svcnost.exe

pid process

984 svcnost.exe
984 svcnost.exe

pid	process
984	svcnost.exe
984	svcnost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xkwtbyzmmjcxhchhsmtusahkcjbhdoqg2\\svcnost.exe\""	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svcnost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe
File created	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

svcnost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML = 373832303735333931	svcnost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry	svcnost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid	process
4964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
4964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid process

4964 abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	pid	process	target process
PID 4964 wrote to memory of 984	4964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe
PID 4964 wrote to memory of 984	4964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe
PID 4964 wrote to memory of 984	4964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe

C:\Users\Admin\AppData\Local\Temp\abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
"C:\Users\Admin\AppData\Local\Temp\abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Roaming\xkwtbyzmmjcxhchhsmtusahkcjbhdoqg2\svcnost.exe
"C:\Users\Admin\AppData\Roaming\xkwtbyzmmjcxhchhsmtusahkcjbhdoqg2\svcnost.exe"
2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\desktop.ini

Filesize
9KB

MD5
4a27242b307c6a836993353035fafc16

SHA1
5fea7a41b8f9071848108015d8a952e6f944eea0

SHA256
02fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1

SHA512
35e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be

Download Submit
C:\Users\Admin\AppData\Roaming\ntuser.dat

Filesize
54KB

MD5
7e8e966927e04a35aec644602b8a9e05

SHA1
d201b0b41e8701818d60ddbf9f334332a512c4da

SHA256
46f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c

SHA512
246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51

Download Submit
memory/984-143-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/984-139-0x0000000000000000-mapping.dmp

Download
memory/984-141-0x00000000005F0000-0x0000000000652000-memory.dmp

Filesize
392KB

Download
memory/984-142-0x0000000002150000-0x00000000021B2000-memory.dmp

Filesize
392KB

Download
memory/984-148-0x0000000000680000-0x000000000069D000-memory.dmp

Filesize
116KB

Download
memory/984-149-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4964-138-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4964-135-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4964-145-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4964-137-0x0000000002110000-0x0000000002172000-memory.dmp

Filesize
392KB

Download
memory/4964-136-0x0000000002090000-0x00000000020F2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads