Analysis
-
max time kernel
282s -
max time network
280s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 11:42
Behavioral task
behavioral1
Sample
LbsClient.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LbsClient.exe
Resource
win10v2004-20230220-en
General
-
Target
LbsClient.exe
-
Size
63KB
-
MD5
762f2fc17465058d27010124bb425202
-
SHA1
1b6b701c9c09128886e4676c4f1e534c7db39ad9
-
SHA256
ae045f8e36db8f38af35258127ff43a71d522ae6ad15b7aad527bf75dd7a7666
-
SHA512
329eacc85396f176fb30989f8d85fbeea097388ab37edecf22c3f4f368c1b0b0106cc7ec5c5ad06abbe488868ce4a5731ab04e4e7852a3d37bb1bdc42bb4e932
-
SSDEEP
768:8FfQVS7rGOe01ZDKMFiw7qyignMEOoCenkHubK23vuEBXKZ7ifudOPJhsAjDOep:Yfo/mKM1qrgnqebKivpaV0udOR3us
Malware Config
Extracted
xworm
ways-examining.at.ply.gg:18120
-
install_file
USB.exe
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1596 cmd.exe -
Drops startup file 2 IoCs
Processes:
LbsClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LbsClient.lnk LbsClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LbsClient.lnk LbsClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
LbsClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\LbsClient = "C:\\Users\\Admin\\AppData\\Roaming\\LbsClient.exe" LbsClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 668 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
LbsClient.exepid process 1388 LbsClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LbsClient.exedescription pid process Token: SeDebugPrivilege 1388 LbsClient.exe Token: SeDebugPrivilege 1388 LbsClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LbsClient.exepid process 1388 LbsClient.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
LbsClient.execmd.exedescription pid process target process PID 1388 wrote to memory of 1596 1388 LbsClient.exe cmd.exe PID 1388 wrote to memory of 1596 1388 LbsClient.exe cmd.exe PID 1388 wrote to memory of 1596 1388 LbsClient.exe cmd.exe PID 1596 wrote to memory of 668 1596 cmd.exe timeout.exe PID 1596 wrote to memory of 668 1596 cmd.exe timeout.exe PID 1596 wrote to memory of 668 1596 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LbsClient.exe"C:\Users\Admin\AppData\Local\Temp\LbsClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3DCC.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3DCC.tmp.batFilesize
161B
MD5455f4a607c3ca33df4bcf329d63f3f14
SHA1d92f3448a84a4ade34c5741d397d485bc8771476
SHA256b3e273ac513357ab1479a2927a7eeb54e4eca711e3857872a69bc44b6b4b8d52
SHA512fbb9a23ab3065e926029a9ecf6cd2aaf4e3c30b5c4162c6237ca1ea9815fe92875b478fb07d6a79e041e33d8021caf0c90187f586d53740d18e52168d22ea8b8
-
C:\Users\Admin\AppData\Local\Temp\tmp3DCC.tmp.batFilesize
161B
MD5455f4a607c3ca33df4bcf329d63f3f14
SHA1d92f3448a84a4ade34c5741d397d485bc8771476
SHA256b3e273ac513357ab1479a2927a7eeb54e4eca711e3857872a69bc44b6b4b8d52
SHA512fbb9a23ab3065e926029a9ecf6cd2aaf4e3c30b5c4162c6237ca1ea9815fe92875b478fb07d6a79e041e33d8021caf0c90187f586d53740d18e52168d22ea8b8
-
memory/1388-54-0x0000000000150000-0x0000000000166000-memory.dmpFilesize
88KB
-
memory/1388-55-0x000000001B110000-0x000000001B190000-memory.dmpFilesize
512KB