e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c

General

Target

e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
Size

55KB
MD5

ff9024b738d98230dd31f41ca9f1c875
SHA1

23162a9529cce98bd20e0ce33985dc70b0cc2b04
SHA256

e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c
SHA512

0d98e28f373d08732257a94957b12d379e584f1fd9e0a77a14b0d04ac649e1278bad0927fc7dd55e51ec66652eeb94fdce2fe981f713d6fb09ddb1d234ef32ca
SSDEEP

768:MGziYmDTjQxWCyqQVViG1AOrsi2fPArDvLLztEq3zQMbfwq/pzA:T9+20qQVVWO14IDXe0Xbfwq/2

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\netserv\Parameters\ServiceDll = "C:\\Windows\\system32\\netservx86.dll"	e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\netserv\ImagePath = "%SystemRoot%\\system32\\svchost -k netserv"	e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2016 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

2016 svchost.exe
Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

svchost.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 svchost.exe

pid	process
2016	svchost.exe

pid	process
2016	svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netservx86.dll	e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\ce-d9-9d-36-8c-9f	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecisionTime = e0e16802e4ffd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecisionTime = e0e16802e4ffd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadNetworkName = "Network 2"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
"C:\Users\Admin\AppData\Local\Temp\e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe"
1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
PID:1672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost -k netserv
1⤵
- Deletes itself
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\netservx86.dll

Filesize
19KB

MD5
f9cc837d8cd3d197d799b3a4b8c7a847

SHA1
f65f55285bb004a1c8084fe824ee2d799f27b424

SHA256
1a923c160dfb182bc2e9a7ef0921624fb75cd9018564e307b7773dac83ed61c5

SHA512
00cd810e4ba295e44e2db8d73a401fd8c7c5ac5538a644c07fc969b0a2712e4d932c4e79bf9d2dd657bced6021d745826d3c448059f0e8d6ec7b0a5ba5a33fe9

Download Submit
\Windows\SysWOW64\netservx86.dll

Filesize
19KB

MD5
f9cc837d8cd3d197d799b3a4b8c7a847

SHA1
f65f55285bb004a1c8084fe824ee2d799f27b424

SHA256
1a923c160dfb182bc2e9a7ef0921624fb75cd9018564e307b7773dac83ed61c5

SHA512
00cd810e4ba295e44e2db8d73a401fd8c7c5ac5538a644c07fc969b0a2712e4d932c4e79bf9d2dd657bced6021d745826d3c448059f0e8d6ec7b0a5ba5a33fe9

Download Submit
memory/1672-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2016-57-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2016-58-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads