Analysis
-
max time kernel
177s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 06:37
Static task
static1
Behavioral task
behavioral1
Sample
de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe
Resource
win10v2004-20230220-en
General
-
Target
de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe
-
Size
302KB
-
MD5
c47f32f68a1ca3309768b48ec98cd752
-
SHA1
ab24f2d6a2cacd0b807b2a174e4c43e8d629b32e
-
SHA256
de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b
-
SHA512
747db0d277eac21cdb2f51862fe861e27b444bdae4ed08bcc92a92d27c75c6ee602723fa102a3501f980bea18bd2c9a500113c6e9cf42d752240e145b1bd610d
-
SSDEEP
3072:Muy7xHO5Ur+3sfGjmvp8hPdJidlfZl8ebAGMR5zODTKchd+OH:xy7xHvrmsejm6d2NZlDAGMHOKcv+y
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\llxbydkj = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\llxbydkj\ImagePath = "C:\\Windows\\SysWOW64\\llxbydkj\\xnnkwiyw.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1508 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
xnnkwiyw.exepid process 1552 xnnkwiyw.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
xnnkwiyw.exedescription pid process target process PID 1552 set thread context of 1508 1552 xnnkwiyw.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 976 sc.exe 868 sc.exe 1736 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exexnnkwiyw.exedescription pid process target process PID 2044 wrote to memory of 628 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 628 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 628 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 628 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 472 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 472 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 472 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 472 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe cmd.exe PID 2044 wrote to memory of 976 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 976 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 976 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 976 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 868 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 868 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 868 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 868 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 1736 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 1736 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 1736 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 1736 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe sc.exe PID 2044 wrote to memory of 296 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe netsh.exe PID 2044 wrote to memory of 296 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe netsh.exe PID 2044 wrote to memory of 296 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe netsh.exe PID 2044 wrote to memory of 296 2044 de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe netsh.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe PID 1552 wrote to memory of 1508 1552 xnnkwiyw.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe"C:\Users\Admin\AppData\Local\Temp\de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\llxbydkj\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xnnkwiyw.exe" C:\Windows\SysWOW64\llxbydkj\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create llxbydkj binPath= "C:\Windows\SysWOW64\llxbydkj\xnnkwiyw.exe /d\"C:\Users\Admin\AppData\Local\Temp\de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description llxbydkj "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start llxbydkj2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\llxbydkj\xnnkwiyw.exeC:\Windows\SysWOW64\llxbydkj\xnnkwiyw.exe /d"C:\Users\Admin\AppData\Local\Temp\de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xnnkwiyw.exeFilesize
12.8MB
MD56a4cad41e61809d83ab435d1e052a290
SHA1ff900ad100bcca84de85714fc7b1e4883101d30d
SHA256cd907683804d4c207ec0a55a8f0d4c1073458b49adb1759c4727b0e0b85f7dc9
SHA5128193a3b546e0424a90352012d4356706d06c570f4aef80da1e93529a640d3a958eb5097c7a8f0cf2421bf39b0b88d56b604b69dc74c2fcb44d0233d29aada3a6
-
C:\Windows\SysWOW64\llxbydkj\xnnkwiyw.exeFilesize
12.8MB
MD56a4cad41e61809d83ab435d1e052a290
SHA1ff900ad100bcca84de85714fc7b1e4883101d30d
SHA256cd907683804d4c207ec0a55a8f0d4c1073458b49adb1759c4727b0e0b85f7dc9
SHA5128193a3b546e0424a90352012d4356706d06c570f4aef80da1e93529a640d3a958eb5097c7a8f0cf2421bf39b0b88d56b604b69dc74c2fcb44d0233d29aada3a6
-
memory/1508-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1508-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1508-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1508-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1508-64-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1508-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1508-66-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1552-68-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2044-55-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2044-61-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/2044-59-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2044-58-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB