df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5

Analysis

max time kernel
151s
max time network
187s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
Size

197KB
MD5

2544aebdac1cda17cee812a54e3d7b99
SHA1

8c28ea7072a1a6afc9361a9db0e265003b5e75c0
SHA256

df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5
SHA512

c66a5001876129ad9a3bc9ccc80132ad4c24b7e3845369c6dc0efef49bc51f64cef284d7a9fbc83c4705f92d098985e4d8ef61fd1144e1cbb619571d1d334818
SSDEEP

3072:zpPku1kPjrU2OCA1yLUtoiHhP0GdOdMBYQ4Rxi9daAAt6h6qoxFh1M1XWGndlfLn:NJ6v+5BPtdv4RY9APqofvMPndDJ

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xuoeuf\Parameters\ServiceDll = "%SystemRoot%\\System32\\swlajr.kll"	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CONTROLSET002\services\xuoeuf\Parameters\ServiceDll = "%SystemRoot%\\System32\\swlajr.kll"	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CONTROLSET003\Services\xuoeuf\Parameters\ServiceDll = "%SystemRoot%\\System32\\swlajr.kll"	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe

Deletes itself 1 IoCs

pid	Process
884	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1248	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
884	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\swlajr.kll	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
File created	C:\Windows\SysWOW64\00051213.sys	df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
884	svchost.exe
884	svchost.exe
884	svchost.exe

C:\Users\Admin\AppData\Local\Temp\df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe
"C:\Users\Admin\AppData\Local\Temp\df68c13c15b37f50c6b1f2917aa73384420a84add5c1a4340519e76f207518b5.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost -k xuoeuf
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\swlajr.kll

Filesize
147KB

MD5
6dbe6a785970c6ebd10f6a8d59e62049

SHA1
152157ae694eae675d8425db09152ec533edc9f7

SHA256
ed61f8519cca97486ffac505d9ababf2e460cbb3e7437020ff96d73b15ee71d9

SHA512
dc84e0d431a5eecb9475a1f48667937571416978d0a0150912c772722e0cba9117cae5b39d4e4b96b43a4041094f73e5a7119783db0c96e107b89c709298f48e

Download Submit
\Windows\SysWOW64\swlajr.kll

Filesize
147KB

MD5
6dbe6a785970c6ebd10f6a8d59e62049

SHA1
152157ae694eae675d8425db09152ec533edc9f7

SHA256
ed61f8519cca97486ffac505d9ababf2e460cbb3e7437020ff96d73b15ee71d9

SHA512
dc84e0d431a5eecb9475a1f48667937571416978d0a0150912c772722e0cba9117cae5b39d4e4b96b43a4041094f73e5a7119783db0c96e107b89c709298f48e

Download Submit
\Windows\SysWOW64\swlajr.kll

Filesize
147KB

MD5
6dbe6a785970c6ebd10f6a8d59e62049

SHA1
152157ae694eae675d8425db09152ec533edc9f7

SHA256
ed61f8519cca97486ffac505d9ababf2e460cbb3e7437020ff96d73b15ee71d9

SHA512
dc84e0d431a5eecb9475a1f48667937571416978d0a0150912c772722e0cba9117cae5b39d4e4b96b43a4041094f73e5a7119783db0c96e107b89c709298f48e

Download Submit
memory/884-61-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download
memory/884-62-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download
memory/1248-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1248-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1248-57-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download