Analysis
-
max time kernel
238s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 15:49
Behavioral task
behavioral1
Sample
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe
Resource
win10v2004-20220812-en
General
-
Target
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe
-
Size
69KB
-
MD5
9ea38549db22318be6020b7e6c82c2d2
-
SHA1
0a36f31f09abbd16b433a4ed3965b9be2ff45a48
-
SHA256
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c
-
SHA512
8b11de3c8feb278c302c7d6792dc9f19862a6b66f0fb7768cb416ee823e66d1aff2b9407c4e823a0e03ea924058aa61a5856cbb10906978e8950c326e6d19061
-
SSDEEP
1536:4aIdJ8LqMbEwOLc3tfnbvTzkeOFjlkHzrbq:4ah3bEwOLc3tfnvzk1vq2
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\hvbs.sys 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe File created C:\Windows\SysWOW64\drivers\hvbs.sys 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nlctj\ImagePath = "system32\\drivers\\hvbs.sys" 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe -
Processes:
resource yara_rule behavioral1/memory/668-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/668-68-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRundll32.exepid process 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 780 Rundll32.exe 780 Rundll32.exe 780 Rundll32.exe 780 Rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exedescription ioc process File created C:\Windows\SysWOW64\phoL.dll 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe File opened for modification C:\Windows\SysWOW64\phoL.dll 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Rundll32.exepid process 780 Rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Rundll32.exepid process 780 Rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exerundll32.exedescription pid process target process PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 668 wrote to memory of 568 668 6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe PID 568 wrote to memory of 780 568 rundll32.exe Rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe"C:\Users\Admin\AppData\Local\Temp\6f69a8ba90daa34a130d97c4f61089a46d21cfaed2b02422f0f1cf89ef0e5f2c.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\phoL.dll,DllRegisterServer2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Rundll32.exeC:\Windows\system32\Rundll32.exe C:\Windows\system32\phoL.dll,DllUnregisterServer3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
\Windows\SysWOW64\phoL.dllFilesize
48KB
MD5d015da42a5db9227e4af6748b052ac6a
SHA1197eb7e76c1c9cd729595a32a716fa6712ab519c
SHA2563c83ffc83fcda25c0448d790d1a0b3dda00d9012fb9affada67911f7efdc20f7
SHA512b987d48ff3028aa350041056b528fdabc30598c7509b759685d543c78631a3d7e5f3cbe0d665c50015db11255b27ba04624c4ec59e07388c1fc2a53951545889
-
memory/568-56-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/568-55-0x0000000000000000-mapping.dmp
-
memory/668-54-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/668-68-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/780-62-0x0000000000000000-mapping.dmp