Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2023 01:14
Static task
static1
Behavioral task
behavioral1
Sample
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
Resource
win10v2004-20230220-en
General
-
Target
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
-
Size
292KB
-
MD5
4e39579f1251ae570e145e352e7393f7
-
SHA1
07497b310187f77e2c18364c7a0e31068be822d1
-
SHA256
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462
-
SHA512
29dd728463e77e3988a074a97b36ebba3f0876e684ea96746b3ec0aeaf78e4ee25182b34a51900b6400fd8a22ea9a911bb15ae195bd04419f8303b9412920009
-
SSDEEP
3072:Xk6e+HiNFjbrieXWP72/BRczZpgAhtBE3k2Bxz+4a2GMW/ft/Dr05xK:7zkjbrFi78BkpgKC3z2YK
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sshwvudn\ImagePath = "C:\\Windows\\SysWOW64\\sshwvudn\\oaqdrqim.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe -
Executes dropped EXE 1 IoCs
Processes:
oaqdrqim.exepid process 3860 oaqdrqim.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oaqdrqim.exedescription pid process target process PID 3860 set thread context of 2784 3860 oaqdrqim.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3204 sc.exe 4456 sc.exe 1488 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1112 1220 WerFault.exe 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe 4776 3860 WerFault.exe oaqdrqim.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 9c8ef03d1b87460124edb47d450dd49d084297dce82e72baa4c0808ad6cad61d1a1498ed84cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56811da8645713fe3ad644490bdb07d27e4975a00cac4e53d428dc9741037fba66517d58d4f750db8f2054991cfdb2470dd906d5d8dc4bf662fd39a460b37f9942e569beb092d60b19d501ec385b37927e99d6d5892a7ec384290c4195804fca16813df8c48703de39d800deebda407c681a46d34fdc58d541d93c206565bbee62b24edb47d440dd49d13477dabc14d14dda46ef8efc78d541de595441332fbba6a11c38648700dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de44e753d04 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exeoaqdrqim.exedescription pid process target process PID 1220 wrote to memory of 2316 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 2316 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 2316 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 3228 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 3228 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 3228 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe cmd.exe PID 1220 wrote to memory of 3204 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 3204 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 3204 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 4456 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 4456 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 4456 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 1488 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 1488 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 1488 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe sc.exe PID 1220 wrote to memory of 3460 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 1220 wrote to memory of 3460 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 1220 wrote to memory of 3460 1220 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe netsh.exe PID 3860 wrote to memory of 2784 3860 oaqdrqim.exe svchost.exe PID 3860 wrote to memory of 2784 3860 oaqdrqim.exe svchost.exe PID 3860 wrote to memory of 2784 3860 oaqdrqim.exe svchost.exe PID 3860 wrote to memory of 2784 3860 oaqdrqim.exe svchost.exe PID 3860 wrote to memory of 2784 3860 oaqdrqim.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sshwvudn\2⤵PID:2316
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oaqdrqim.exe" C:\Windows\SysWOW64\sshwvudn\2⤵PID:3228
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create sshwvudn binPath= "C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe /d\"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3204
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description sshwvudn "wifi internet conection"2⤵
- Launches sc.exe
PID:4456
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start sshwvudn2⤵
- Launches sc.exe
PID:1488
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:3460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 12722⤵
- Program crash
PID:1112
-
-
C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exeC:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe /d"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 5082⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1220 -ip 12201⤵PID:3492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3860 -ip 38601⤵PID:2220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.6MB
MD53e77e039f6639b6ca3938e5efa785a3e
SHA1304c50482b14619ca56a5c135f29d3b0576edcd5
SHA256f82216cb96fffd41ee5c28649ce274a886b60757fb755e0fade44b636188c76a
SHA5120a92f11ed241bc83ea417f1ddfdba53931653e40f917f8d1c70f24299527687ec55772061a3f63c0fc6d68218959c8a9d771cf37de5f3fb7b9155633fc825cfb
-
Filesize
14.6MB
MD53e77e039f6639b6ca3938e5efa785a3e
SHA1304c50482b14619ca56a5c135f29d3b0576edcd5
SHA256f82216cb96fffd41ee5c28649ce274a886b60757fb755e0fade44b636188c76a
SHA5120a92f11ed241bc83ea417f1ddfdba53931653e40f917f8d1c70f24299527687ec55772061a3f63c0fc6d68218959c8a9d771cf37de5f3fb7b9155633fc825cfb