Analysis
-
max time kernel
229s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe
Resource
win10v2004-20230221-en
General
-
Target
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe
-
Size
303KB
-
MD5
531df55984e2b66ad9f0dbd639de601e
-
SHA1
dc9d0df60d45c19e668e99a39946d1d39a5d9a09
-
SHA256
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f
-
SHA512
1a2029171755e8c7f4f374af5544eef317a0d1635272991b7535f4406a99b4ef5d70985602fd85c8b9eb40de2215c81be496157821f78a013cea74ad2848e72b
-
SSDEEP
3072:MuFL7HO/Wc2L/rIUpqfM/FqdAt/XOM5TJDTnmhd+:xFL7HQ2LrI7fg2AtXJnmv+
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe -
Executes dropped EXE 1 IoCs
Processes:
qcotqwvj.exepid process 1596 qcotqwvj.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4328 sc.exe 4292 sc.exe 3080 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4448 2268 WerFault.exe e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exedescription pid process target process PID 2268 wrote to memory of 3960 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 3960 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 3960 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 2108 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 2108 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 2108 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe cmd.exe PID 2268 wrote to memory of 4328 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 4328 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 4328 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 4292 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 4292 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 4292 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 3080 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 3080 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 3080 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe sc.exe PID 2268 wrote to memory of 3856 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe netsh.exe PID 2268 wrote to memory of 3856 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe netsh.exe PID 2268 wrote to memory of 3856 2268 e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe"C:\Users\Admin\AppData\Local\Temp\e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zpslkdnu\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qcotqwvj.exe" C:\Windows\SysWOW64\zpslkdnu\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create zpslkdnu binPath= "C:\Windows\SysWOW64\zpslkdnu\qcotqwvj.exe /d\"C:\Users\Admin\AppData\Local\Temp\e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description zpslkdnu "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zpslkdnu2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 6722⤵
- Program crash
-
C:\Windows\SysWOW64\zpslkdnu\qcotqwvj.exeC:\Windows\SysWOW64\zpslkdnu\qcotqwvj.exe /d"C:\Users\Admin\AppData\Local\Temp\e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2268 -ip 22681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qcotqwvj.exeFilesize
13.3MB
MD53abe8d32d07cd4a9bb95ea61a7280dec
SHA102e703eb008b91eca418e905526885c5ae494e09
SHA256a07deac34701ad47a3ee0847a83b5f4c760907dd0239b9868c83c9152d457d0a
SHA5128c74499c8a62d1d45a7ccb3244d6faf196eaac5f1e48e8054f7cc251c375c2a0c17d70dac7f8163bc00a9994b0ff2f2eb9e97eab218be5dc4128b65d7eaf28c0
-
C:\Windows\SysWOW64\zpslkdnu\qcotqwvj.exeFilesize
13.3MB
MD53abe8d32d07cd4a9bb95ea61a7280dec
SHA102e703eb008b91eca418e905526885c5ae494e09
SHA256a07deac34701ad47a3ee0847a83b5f4c760907dd0239b9868c83c9152d457d0a
SHA5128c74499c8a62d1d45a7ccb3244d6faf196eaac5f1e48e8054f7cc251c375c2a0c17d70dac7f8163bc00a9994b0ff2f2eb9e97eab218be5dc4128b65d7eaf28c0
-
memory/1596-146-0x0000000000D80000-0x0000000000D93000-memory.dmpFilesize
76KB
-
memory/1596-147-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2268-134-0x0000000002790000-0x00000000027A3000-memory.dmpFilesize
76KB
-
memory/2268-135-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2268-136-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2268-139-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2268-150-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB