Analysis
-
max time kernel
147s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-05-2023 01:14
Static task
static1
Behavioral task
behavioral1
Sample
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
Resource
win10v2004-20230220-en
General
-
Target
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
-
Size
292KB
-
MD5
4e39579f1251ae570e145e352e7393f7
-
SHA1
07497b310187f77e2c18364c7a0e31068be822d1
-
SHA256
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462
-
SHA512
29dd728463e77e3988a074a97b36ebba3f0876e684ea96746b3ec0aeaf78e4ee25182b34a51900b6400fd8a22ea9a911bb15ae195bd04419f8303b9412920009
-
SSDEEP
3072:Xk6e+HiNFjbrieXWP72/BRczZpgAhtBE3k2Bxz+4a2GMW/ft/Dr05xK:7zkjbrFi78BkpgKC3z2YK
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ltywuewf = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ltywuewf\ImagePath = "C:\\Windows\\SysWOW64\\ltywuewf\\dkjweemq.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 936 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
dkjweemq.exepid process 928 dkjweemq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dkjweemq.exedescription pid process target process PID 928 set thread context of 936 928 dkjweemq.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1476 sc.exe 332 sc.exe 1748 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exedkjweemq.exedescription pid process target process PID 1524 wrote to memory of 868 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 868 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 868 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 868 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 568 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 568 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 568 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 568 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1524 wrote to memory of 1476 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1476 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1476 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1476 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 332 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 332 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 332 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 332 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1748 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1748 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1748 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1748 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1524 wrote to memory of 1464 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 1524 wrote to memory of 1464 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 1524 wrote to memory of 1464 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 1524 wrote to memory of 1464 1524 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe PID 928 wrote to memory of 936 928 dkjweemq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ltywuewf\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dkjweemq.exe" C:\Windows\SysWOW64\ltywuewf\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ltywuewf binPath= "C:\Windows\SysWOW64\ltywuewf\dkjweemq.exe /d\"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ltywuewf "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ltywuewf2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\ltywuewf\dkjweemq.exeC:\Windows\SysWOW64\ltywuewf\dkjweemq.exe /d"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dkjweemq.exeFilesize
14.1MB
MD54a784b9fb2f1e9d74e5fe6ff01fc1adc
SHA1e435981edacf0112f9efcdc86ba6a5b09aad02f2
SHA25656ea1b6849cdf6f47e907231b9f85e36669a83ecd0cbc6f3168dce370e9a0582
SHA51293ef93c8bf37ffa21b64a4cd0cfdb51b8cf0e8bf9684ae1bc11e190d7dc86475fb87489c7a00794cd4a730bc5d266ef2b5169f03ef6e934fb533859ba0219dc2
-
C:\Windows\SysWOW64\ltywuewf\dkjweemq.exeFilesize
14.1MB
MD54a784b9fb2f1e9d74e5fe6ff01fc1adc
SHA1e435981edacf0112f9efcdc86ba6a5b09aad02f2
SHA25656ea1b6849cdf6f47e907231b9f85e36669a83ecd0cbc6f3168dce370e9a0582
SHA51293ef93c8bf37ffa21b64a4cd0cfdb51b8cf0e8bf9684ae1bc11e190d7dc86475fb87489c7a00794cd4a730bc5d266ef2b5169f03ef6e934fb533859ba0219dc2
-
memory/928-64-0x0000000000400000-0x00000000006C7000-memory.dmpFilesize
2.8MB
-
memory/936-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/936-61-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/936-63-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/936-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/936-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/936-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/936-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1524-56-0x00000000003A0000-0x00000000003B3000-memory.dmpFilesize
76KB
-
memory/1524-59-0x0000000000400000-0x00000000006C7000-memory.dmpFilesize
2.8MB