Analysis
-
max time kernel
143s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-05-2023 06:45
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
298KB
-
MD5
b7c137a18093f43fa0ac50865cc34f9c
-
SHA1
93727de39d92f6934d4ddee26728b207a212428e
-
SHA256
63e235b92d97d6c3d5a5dca42f31279b674d3140affc1e26c5971d12fc1d7667
-
SHA512
40683347b6f3dd2f18d15d5bfaa64d98f6ca88d1497bac811483366c59e5c786914dd32445981f774666b20053390f18d5a01f278162ba85bf75866edf6c95d6
-
SSDEEP
3072:/UgGk8D2CKiH+U3XmE5kDOXkqVDE/zpUp+rqdyy76kgREiwUP7A6qVxWm5iT/Hrq:Ret/X/GDwpELm04B710Ej2qVA8i
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dgkctder = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dgkctder\ImagePath = "C:\\Windows\\SysWOW64\\dgkctder\\kistvrua.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1532 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
kistvrua.exepid process 1804 kistvrua.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kistvrua.exedescription pid process target process PID 1804 set thread context of 1532 1804 kistvrua.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 584 sc.exe 564 sc.exe 1320 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exekistvrua.exedescription pid process target process PID 1604 wrote to memory of 1236 1604 file.exe cmd.exe PID 1604 wrote to memory of 1236 1604 file.exe cmd.exe PID 1604 wrote to memory of 1236 1604 file.exe cmd.exe PID 1604 wrote to memory of 1236 1604 file.exe cmd.exe PID 1604 wrote to memory of 1072 1604 file.exe cmd.exe PID 1604 wrote to memory of 1072 1604 file.exe cmd.exe PID 1604 wrote to memory of 1072 1604 file.exe cmd.exe PID 1604 wrote to memory of 1072 1604 file.exe cmd.exe PID 1604 wrote to memory of 584 1604 file.exe sc.exe PID 1604 wrote to memory of 584 1604 file.exe sc.exe PID 1604 wrote to memory of 584 1604 file.exe sc.exe PID 1604 wrote to memory of 584 1604 file.exe sc.exe PID 1604 wrote to memory of 564 1604 file.exe sc.exe PID 1604 wrote to memory of 564 1604 file.exe sc.exe PID 1604 wrote to memory of 564 1604 file.exe sc.exe PID 1604 wrote to memory of 564 1604 file.exe sc.exe PID 1604 wrote to memory of 1320 1604 file.exe sc.exe PID 1604 wrote to memory of 1320 1604 file.exe sc.exe PID 1604 wrote to memory of 1320 1604 file.exe sc.exe PID 1604 wrote to memory of 1320 1604 file.exe sc.exe PID 1604 wrote to memory of 1716 1604 file.exe netsh.exe PID 1604 wrote to memory of 1716 1604 file.exe netsh.exe PID 1604 wrote to memory of 1716 1604 file.exe netsh.exe PID 1604 wrote to memory of 1716 1604 file.exe netsh.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe PID 1804 wrote to memory of 1532 1804 kistvrua.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dgkctder\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kistvrua.exe" C:\Windows\SysWOW64\dgkctder\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create dgkctder binPath= "C:\Windows\SysWOW64\dgkctder\kistvrua.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description dgkctder "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start dgkctder2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\dgkctder\kistvrua.exeC:\Windows\SysWOW64\dgkctder\kistvrua.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kistvrua.exeFilesize
11.1MB
MD5875edc3c35fea20eef6df299df615435
SHA1d78adce56abaf79ca033df4c1eef0d240011a8a6
SHA256ee1da0595f339d2416912e5d63f31cd367e2f0a52702ab539145db3b60e3217e
SHA51281769ffec0cd786e8a1aba272608c91b7d5dde958b838b6eb1cf9d51fecad287e91db93c793172e68ee1cf77de7e78cfe8768ed1514dd80b234cc9387da98d3c
-
C:\Windows\SysWOW64\dgkctder\kistvrua.exeFilesize
11.1MB
MD5875edc3c35fea20eef6df299df615435
SHA1d78adce56abaf79ca033df4c1eef0d240011a8a6
SHA256ee1da0595f339d2416912e5d63f31cd367e2f0a52702ab539145db3b60e3217e
SHA51281769ffec0cd786e8a1aba272608c91b7d5dde958b838b6eb1cf9d51fecad287e91db93c793172e68ee1cf77de7e78cfe8768ed1514dd80b234cc9387da98d3c
-
memory/1532-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1532-62-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1532-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1532-64-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1532-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1532-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1532-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1604-59-0x0000000000400000-0x00000000006C8000-memory.dmpFilesize
2.8MB
-
memory/1604-56-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1804-61-0x0000000000230000-0x0000000000243000-memory.dmpFilesize
76KB
-
memory/1804-66-0x0000000000400000-0x00000000006C8000-memory.dmpFilesize
2.8MB