Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:34
Static task
static1
Behavioral task
behavioral1
Sample
18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe
Resource
win10v2004-20230220-en
General
-
Target
18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe
-
Size
303KB
-
MD5
dd18a455e9d700d656ce6965cee1a068
-
SHA1
bb23d970e98a6a6ec178fc6c9c82689b3e92ee7c
-
SHA256
18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207
-
SHA512
71dc5ce080f2f95f2b68bcd135cfbbb9d020e10f58972b4f90ac98a3794f7791857139d45f417d127182bb26caca996a94c95008f2fc0ccc8a3c1b16dd07b531
-
SSDEEP
3072:duhpDHOnUv1WfCBuL4IdkVDJNhA+GHRIBiSp5z5DT4zknffhd+OH:shpDH9vEfQQrdkB7Fi05ykn3v+y
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tiutgkcm\ImagePath = "C:\\Windows\\SysWOW64\\tiutgkcm\\oeapkcai.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 692 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
oeapkcai.exepid process 976 oeapkcai.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oeapkcai.exedescription pid process target process PID 976 set thread context of 692 976 oeapkcai.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1736 sc.exe 1204 sc.exe 1108 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exeoeapkcai.exedescription pid process target process PID 924 wrote to memory of 436 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 436 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 436 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 436 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 1416 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 1416 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 1416 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 1416 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe cmd.exe PID 924 wrote to memory of 1736 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1736 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1736 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1736 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1204 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1204 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1204 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1204 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1108 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1108 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1108 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1108 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe sc.exe PID 924 wrote to memory of 1268 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe netsh.exe PID 924 wrote to memory of 1268 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe netsh.exe PID 924 wrote to memory of 1268 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe netsh.exe PID 924 wrote to memory of 1268 924 18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe netsh.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe PID 976 wrote to memory of 692 976 oeapkcai.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe"C:\Users\Admin\AppData\Local\Temp\18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tiutgkcm\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oeapkcai.exe" C:\Windows\SysWOW64\tiutgkcm\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create tiutgkcm binPath= "C:\Windows\SysWOW64\tiutgkcm\oeapkcai.exe /d\"C:\Users\Admin\AppData\Local\Temp\18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description tiutgkcm "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start tiutgkcm2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\tiutgkcm\oeapkcai.exeC:\Windows\SysWOW64\tiutgkcm\oeapkcai.exe /d"C:\Users\Admin\AppData\Local\Temp\18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oeapkcai.exeFilesize
10.6MB
MD5feca19f5412e401aed16f6594cb40dc4
SHA173ff2105ca4cc9531a364b24ba4874ba0638d076
SHA256064fcc6308f7d12b308756a532ccedf54bcf1cb30928e3773fd30fed0d13b662
SHA5126ef47a7562f67221141c0638842f7604f2a79c5afeef2a45fbb4c9b69098efb549542e7db199fc44fff9a93928db56f08812c36633fa4f74ef8431b4c8fa06e2
-
C:\Windows\SysWOW64\tiutgkcm\oeapkcai.exeFilesize
10.6MB
MD5feca19f5412e401aed16f6594cb40dc4
SHA173ff2105ca4cc9531a364b24ba4874ba0638d076
SHA256064fcc6308f7d12b308756a532ccedf54bcf1cb30928e3773fd30fed0d13b662
SHA5126ef47a7562f67221141c0638842f7604f2a79c5afeef2a45fbb4c9b69098efb549542e7db199fc44fff9a93928db56f08812c36633fa4f74ef8431b4c8fa06e2
-
memory/692-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/692-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/692-65-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/692-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/692-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/692-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/692-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/924-62-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/924-57-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB
-
memory/924-56-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/976-71-0x0000000000400000-0x0000000000A5C000-memory.dmpFilesize
6.4MB